VehApiResolve

VehApiResolve Ispirato da offuscamento API a 32 bit di Dridex Loader. Come funziona? Configuriamo un gestore di eccezioni. root@kitploit: AddVectoredExceptionHandler CALLFIRST, ApiResolverHandler ; Questo gestore di eccezioni gestirà solo eccezioni generate come EXCEPTIONBREAKPOINT. Quando viene...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...