VehApiResolve

VehApiResolve Inspired by Dridex Loader's 32 bit API obfuscation. How does this work? We setup an exception handler. AddVectoredExceptionHandler CALLFIRST, ApiResolverHandler ; This exception handler will only handle exception's thrown as EXCEPTIONBREAKPOINT. When it is thrown by us, we're able t...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...