VehApiResolve

VehApiResolve Inspirado por la ofuscación de API de 32 bits del cargador Dridex. ¿Cómo funciona esto? Configuramos un manejador de excepciones. root@kitploit: AddVectoredExceptionHandler CALLFIRST, ApiResolverHandler ; Este manejador de excepciones solo manejará las excepciones lanzadas como...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...