Reverse Engineering

Facebook Twitter
We've recently released our malware document scanner tool called Cryptam (which stands for cryptanalysis of malware) . This system scans document files such as MS Office (.doc/.ppt/.xls), PDF and other document formats for embedded executables whether encrypted or not. As most embedded malware executables use varying lengths of XOR and ROL/ROR obfuscation to evade traditional A/V detection, we focus on the detection of the embedded executable rather than the exploit itself. A typical Cryptam report visually shows three critical pieces of the cryptanalysis done. The first graph shows the count for each ascii character in the file, obvious single byte XOR keys can be seen here. The second graph is the entropy of the file, most documents other than PDFs are very light entropy on legitimate content, and only images or the embedded executables showing as red high entropy sections. malware tracker blog: New malware document scanner tool released malware tracker blog: New malware document scanner tool released
malware tracker: cryptam malware analysis
Bernardo Damele A. G.: Dump Windows password hashes efficiently - Part 1 Bernardo Damele A. G.: Dump Windows password hashes efficiently - Part 1 Windows Security Account Manager Slightly modified definition from Wikipedia: The Security Accounts Manager (SAM) is a registry file in Windows NT and later versions until the most recent Windows 7.
<div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. </div> Embedding Examples and Help Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 3 : Xeno Kovah Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 3 : Xeno Kovah
<div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. </div> Embedding Examples and Help Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 4 : Xeno Kovah Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 4 : Xeno Kovah
Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 5 : Xeno Kovah Introductory Intel x86: Architecture, Assembly, Applications, Day 1, Part 5 : Xeno Kovah <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature.
Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 1 : Xeno Kovah <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. </div> Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 1 : Xeno Kovah
Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 2 : Xeno Kovah <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. </div> Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 2 : Xeno Kovah
<div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 3 : Xeno Kovah Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 3 : Xeno Kovah
Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 4 : Xeno Kovah Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 4 : Xeno Kovah <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature.
Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 5 : Xeno Kovah <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on. Please see your browser settings for this feature. </div> Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 5 : Xeno Kovah
Introductory Intel x86: Architecture, Assembly, Applications, Day 2, Part 6 : Xeno Kovah <div style="padding:5px; font-size:80%; width:300px; background-color:white; margin-left:auto; margin-right:auto; border:1px dashed gray;"> Internet Archive's<!--'--> in-browser video player requires JavaScript to be enabled. It appears your browser does not have it turned on.
IntroX86 Creator: Xeno Kovah @XenoKovah License: Creative Commons: Attribution, Share-Alike (http://creativecommons.org/licenses/by-sa/3.0/) Class Prerequisites: Must have a basic understanding of the C programming language, as this class will show how C code corresponds to assembly code. Lab Requirements: Requires a Windows system with Visual C++ Express Edition. Requires a Linux system with gcc and gdb, and the CMU binary bomb installed.
The current threat landscape around cyber attacks is complex and hard to understand even for IT pros. The media coverage on recent events increases the challenge by putting fundamentally different attacks into the same category, often labeled as advanced persistent threats (APTs). The resulting mix of attacks includes everything from broadly used, exploit-kit driven campaigns driven by cyber criminals, to targeted attacks that use 0-day vulnerabilities and are hard to fend off - blurring the threat landscape, causing confusion where clarity is most needed. This article analyzes a specific incident - last March’s RSA breach, explaining the techniques used by the attackers and detailing the vulnerability used to gain access to the network. It further explores the possible mitigation techniques available in current software on the OS and application level to prevent such attacks from reoccurring. Into the Darkness: Dissecting Targeted Attacks | Qualys Security Labs
Já está circulando há um tempo mensagens de phishing que utilizam o nome do Ministério Público Federal e do Departamento de Polícia Federal falando de uma suposta intimação para comparecer em uma audiência. Hoje recebi mais uma desse tipo e resolvi analisar, vamos ver o que conseguimos. Identificação do Artefato Ao clicar no link do e-mail foi feito o download do arquivo: Crimes Cibernéticos: Análise do Malware Intimação-MPF
This webcast introduces you to practical approaches of reverse-engineering malicious software on a Windows system. I cover behavioral and code analysis phases, to make this topic accessible even to individuals with a limited exposure to programming concepts. You'll learn the fundamentals and associated tools to get started with malware analysis. Introduction to Malware Analysis - Free Recorded Webcast by Lenny Zeltser
Reverse-Engineering Malware Cheat Sheet by Lenny Zeltser
Analyzing Malicious Documents Cheat Sheet by Lenny Zeltser
5 Steps to Building a Malware Analysis Toolkit Using Free Tools by Lenny Zeltser
REMnux 1.0: the malware analyst's playground
Homepage
Advanced Persistent Tweets: Zero-Day in 140 Characters
netifera
BitBlaze: Binary Analysis for Computer Security
Segurança da Informação
Projeto Malwares-BR - Início
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code (9780470613030): Michael Ligh, Steven Adair, Blake Hartstein, Matthew Richard
Reversing: Secrets of Reverse Engineering (9780764574818): Eldad Eilam
Hacking: The Art of Exploitation, 2nd Edition (9781593271442): Jon Erickson
Yashira.org
Software - CERT.at
.:: Phrack Magazine ::.
What is heap and stack?
Heap: Pleasures and Pains
Heap spraying
Heap (data structure)
ERESI – Trac
Reverse-Engineering Malware: Malware Analysis Tools and Techniques Course - Malware Analysis Training by Lenny Zeltser
zerowine.sourceforge
Vulnerability Research Blog ( Vulnerabilities, Exploits, Threats, 0-Days)
Malware Analysis, Virus Sandbox - CWSandbox an Automated Malware Analysis Tool
:: mwanalysis :: CWSandbox ::
Free Malicious PDF Analysis E-book