nganhkhoa/mether049-malware
1
0
Fork 0
mirror of https://github.com/nganhkhoa/malware.git synced 2024-06-10 21:32:07 +07:00
Code Issues Projects Releases Wiki Activity

Update malware-analysis_ref_and_memo.md

Browse Source
This commit is contained in:
mether049 2020-07-26 22:28:26 +09:00 committed by GitHub
parent a89e213f3b
commit d5343bf6c4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
malware-analysis_ref_and_memo.md
View File

@ -367,6 +367,14 @@ Injecition/Hollowingされたプロセスの自動検出<br>
- Trickbotの復号に関する記事
- **[de4dot](https://github.com/0xd4d/de4dot)**
- .NET系のDeofuscatorおよびUnpacker
- **[formbook_decrypt_hash_string.py](https://github.com/ThisIsSecurity/malware/tree/master/formbook)**
- BZip2 CRC32 hash arrayの復号
- formbookの検体内の文字列の復号
- formbookがProcess Hollowingに使用するプロセス名の復号
- formbookが使用するc2 URIの復号
- etc.
- **[formbook_decode_pcap.py](https://github.com/ThisIsSecurity/malware/tree/master/formbook)**
- formbookの通信のデコードプログラム
# PDF Analysis