[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

MelviBaf
2020-08-30 12:27
You actually reported this really well!
http://seolife.in.ua/go.php?url=https://canadianonlinepharmacyhere.com http://bestfatclips.com/cgi-bin/atx/out.cgi?id=28&trade=https://msnviagrarx.com http://zjjiajiao.cn/ad/adredir.asp?url=https://canadianpharmaciesmsn.com http://www.acuracatalog.com/redirect.php?link=https://topcialisrxpills.com http://dcfever.com/click.php?id=model_lunaworks&url=https://csvcialis.com http://www.u-u-ah.net/buzz/create/L.php?ID=&CA=game&TXT=1276536653&URL++https://topviagrarxpills.com http://pixel.nascimpact.com/go.php?url=https://msncialis.com http://www.eurogirls17.com/cgi-bin/at3/out.cgi?id=724&tag=toplist&trade=https://topviagrarxstore.com
rrmaygvegjek
2020-08-30 12:02
80258 87736 82066 51112
http://bitly.com/1ntFjX
80124 17039 70036 89468
http://bitly.com/1ntFjX - Вратарь Галактики смотреть онлайн 98375 88133 28759 64206
RobertBap
2020-08-30 11:32
Whoa all kinds of good facts! canadian pharmacies https://topviagrarxpills.com pharmacies near me
ScottGuith
2020-08-30 11:14
Nicely put, With thanks! discount prescription drug http://canadianpharmaciesrxstore.com/order-ceclor-cd-online-en.html walgreens pharmacy online
MelviBaf
2020-08-30 10:27
Whoa plenty of excellent advice!
http://gta-action.ru/go.php?url=https://canadianpharmacyfirst.com http://www.trannypool.com/movies/go.php?id=1131246_1&url=https://ntviagrausa.com http://mgnews.ru/redirect/go?to=https://canadianpharmacyfirst.com http://www.phpkida.com/website-review/redirect.php?url=https://csvcialis.com https://www.asiamh.ru/bitrix/rk.php?id=35&event1=banner&event2=click&event3=1+%2F+%5B35%5D+%5Bright_3b%5D+%C0%F0%E5%ED%E4%E0&goto=https://canadianpharmaceuticalsrx.com http://maps.google.pl/url?q=https://ntviagrausa.com http://natd.gov.kz/bitrix/redirect.php?event1=document&event2=download&goto=https://msnviagrarx.com http://www.motordebusca.pt/busca/redir.asp?idsite=7950&url=https://canadianrxpillusa.com https://www.hoteljob.in.th/preload.php?url=https://canadianpharmacyed.com http://madamandlady.net/m/redirect.php?url=https://msnviagrarx.com https://memorialservices.lv/redirect/url/?url=https://canadianonlinepharmacyhere.com
MelviBaf
2020-08-30 09:50
Fine material. Many thanks!
http://obuvka.net.ua/redirect.php?action=url&goto=https://topcialisrxpills.com http://accessdatabasedevelopers.com/Services/Redirect.aspx?url=https://canadianpharmacy-us.com http://maps.google.lv/url?q=https://canadianpharmaciesrxstore.com http://paidtosin.com/ttt-out.php?pct=90&url=https://msnviagrarx.com http://www.shahter.ru/mz/click.php?url=https://topcialisrxstore.com http://www.zaharonim.org.il/redir.asp?url=https://canadianpharmaciesmsn.com http://www.freeporngirlfriend.com/crtr/cgi/out.cgi?id=40&l=thumbs1&u=https://topcialisrxstore.com http://alothome.com/Go.aspx?rurl=https://canadianonlinepharmacyhere.com https://thecuttingedgenews.com/index.php?ad=11223&url=https://canadianpharmacyed.com http://mikro.andi.lv/bitrix/rk.php?id=59&event1=banner&event2=click&event3=3+/+<>9]+<mikro>top]+SunlighSailing+RU&goto=https://canadianpharmaciesmsn.com
KeitrSax
2020-08-30 09:41
Nicely voiced genuinely! . canadian pharcharmy online https://dissertationwritingtops.com pharmeasy
liquid tadalafil
2020-08-30 07:21
cialis coupon http://loncialis.com/ cialis without prescription
RobertBap
2020-08-30 07:01
Whoa a lot of very good tips. canada meds https://homeworkcourseworkhelps.com order medicine online
cialis soft
2020-08-30 06:19
tadalafil 20 mg http://loncialis.com/ tadalafil liquid
MelviBaf
2020-08-30 06:05
Many thanks! A lot of forum posts!  
http://sat.kuz.ru/engine/redirect.php?url=https://canadianonlinepharmacyhere.com http://www.skitalets.ru/links/jump.php?url=https://ntviagrausa.com https://matome-ch.com/jump.php?u=https://canadianonlinepharmacyhere.com http://www.nozokix.com/ltp_out?id=01589&go=https://cadmedbb.com https://www.frontrush.com/FR_Web_App/Message/MessageTracking.aspx?code=Mjg4MjUwOTsxMjYwODU2O0M7MTc1ODQ7TA==-Vve8qeRh36c=&redir=https://canadianpharmaceuticalsrx.com http://www.jstott.com/links/jump.php?id=41&url=https://csvcialis.com http://nanacast.com/vp/113596/499565/free-ebook/?redirecturl=https://topcialisrxpills.com http://www.woningmakelaar-groningen.nl/redirect.php?id=2502&url=https://ntviagrausa.com
RobertBap
2020-08-30 05:31
Incredible a good deal of valuable advice. pharmacy prices compare https://cialisrxmsn.com trust pharmacy canada
ScottGuith
2020-08-30 03:56
Seriously a lot of superb facts. canada online pharmacies http://topviagrarxstore.com/order-levlen-online-en.html buying drugs canada
MelviBaf
2020-08-30 02:47
Amazing postings, With thanks.
http://konga.postaffiliatepro.com/scripts/click.php?k_id=9janinja&desturl=https://cadmedbb.com http://www.seniortgp.com/cgi-bin/crtr/out.cgi?u=https://topviagrarxstore.com http://www.freehqpornmovies.com/cgi-bin/atc/out.cgi?c=1&s=80&l=index&u=https://ntviagrausa.com http://www.kyivfashion.kiev.ua/?goto=https://cadmedbb.com http://bethplanet.ru/go?https://canadianpharmaciesmsn.com http://www.amateurlesbiansex.com/cgi-bin/atx/out.cgi?s=65&u=https://csvcialis.com https://www.mls2u.com/Frame--Flat-Fee-MLS.php?src=https://canadianpharmaceuticalsrx.com http://www.seelensturm.net/wcf/acp/dereferrer.php?url=https://canadianpharmaceuticalsrx.com http://www.belclimb.net/click_counter.asp?countType=link&ID=1590&target=https://rxpharmacymsn.com http://www.phpxs.com/fenxiang/manual?go=https://topviagrarxpills.com http://www.parmalat.ru/bitrix/rk.php?id=7&event1=banner&event2=click&event3=1+%2F+%5B7%5D+%5BMAIN%5D+%CC%EE%EB%EE%F7%ED%FB%E5+%EF%F0%EE%E4%F3%EA%F2%FB+%C1%E5%EB%FB%E9+%C3%EE%F0%EE%E4&goto=https://canadianonlinepharmacyhere.com http://polit.nnov.ru/go.php?url=https://canadianrxpillusa.com http://redirect.fairfax.com.au/redir.cgi?from_site=fu2&from_section=electronics_index.html&to=https://canadianpharmaciesmsn.com
ScottGuith
2020-08-30 02:28
Kudos! I like this! canadian drugs pharmacies online http://canadiantoprxstore.com/order-precose-online-en.html overseas pharmacy forum

发表评论:

Powered by emlog