Also, my webcast on getting started with malware analysis using REMnux showed several other Unix-based tools useful for this work. In an earlier post I discussed how to extract static property details a Linux environment by using MASTIFF. Let's take a look at several free Windows tools that are useful for extracting such meta data from potentially-malicious executables. This effort allows you to perform an initial assessment of the file without even infecting a lab system or studying its code. The ‘strings section’ of the sample analyzed is presented below.Immediately apply the skills and techniques learned in SANS courses, ranges, and summitsĮxamining static properties of suspicious files is a good starting point for malware analysis. When the number of readable characters is reduced, the application could be packed or obfuscated. In examining the ‘strings section’, the analyst is trying to identify readable strings, such as IPs and URLs, and filenames that can be used during the investigation. All the strings from the executable are parsed and placed in this section. The ‘strings section’ is also a useful source of information for the analyst. Using this functionality, the malware creator can hide code inside the TLS (Thread Local Storage) that will be executed before Windows OS creates the process. This code will be executed before the entry point. The section ‘ tls-callback’ has the code that will set up the environment, so the application can run. If the malicious application has dropper5 functionalities, the files that are written on the disk could be stored in the ‘.rsrc’ section.
The ‘resources section’ usually stores the information related to UI (icons or custom window elements).
ISRO CS Original Papers and Official Keys.GATE CS Original Papers and Official Keys.DevOps Engineering - Planning to Production.Python Backend Development with Django(Live).Android App Development with Kotlin(Live).Full Stack Development with React & Node JS(Live).
0 kommentar(er)
