From 27a674c854bef059db618e8d2a16f731eaa34a04 Mon Sep 17 00:00:00 2001 From: mether049 Date: Tue, 3 Mar 2020 03:28:51 +0900 Subject: [PATCH] Update malware-tech_ref_and_memo.md --- malware-tech_ref_and_memo.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/malware-tech_ref_and_memo.md b/malware-tech_ref_and_memo.md index 931552b..dda32d2 100644 --- a/malware-tech_ref_and_memo.md +++ b/malware-tech_ref_and_memo.md @@ -337,10 +337,10 @@ New-Object System.IO.Compression.DeflateStream([iO.mEmoRySTream] [sysTEM.ConVert - 上記の機能はAutoIT Scriptとしてバイナリに埋め込まれる - AutoIT Scriptは難読化されている > - Change the character order.
- > -Change the strings to hexadecimal.
- > -XOR with constant values.
- > -Rotate the strings.
- > -Embed many non-ASCII characters.
+ > - Change the strings to hexadecimal.
+ > - XOR with constant values.
+ > - Rotate the strings.
+ > - Embed many non-ASCII characters.
- ref: - [DeCypherIT – All eggs in one basket](https://research.checkpoint.com/2019/decypherit-all-eggs-in-one-basket/)