mirror of
https://github.com/aljazceru/securedorg.github.io.git
synced 2026-01-06 07:44:23 +01:00
updating lines
This commit is contained in:
@@ -13,6 +13,7 @@ Static analysis is like reading a map for directions on where to go. As you foll
|
||||
|
||||
This section will teach you how to jump into code in static disassembly then rename and comment on interesting assembly routines that we will debug in **Section 6**.
|
||||
|
||||
---
|
||||
|
||||
## LAB 2
|
||||
|
||||
@@ -126,7 +127,8 @@ Let's use the tool **XORSearch** to see if we can find some interesting xor deco
|
||||
|
||||
Let's navigate to the start of the program using the **X** key. Use the spacebar to toggle between graph view and text view.
|
||||
|
||||

|
||||
*Click Image to Enlarge*
|
||||
[](https://securedorg.github.io/images/static7.gif)
|
||||
|
||||
It's easy to trace back through the program disassembly, but let's look at some control flow assembly instructions. Remember **jmp, jne, jnz, jnb** are control flow functions.
|
||||
|
||||
|
||||
@@ -24,6 +24,8 @@ This checklist should get you started:
|
||||
- Quick VM Detonation
|
||||
- Capture network information
|
||||
|
||||
---
|
||||
|
||||
## Download the Unknown Malware
|
||||
|
||||
[**HERE**](https://drive.google.com/open?id=0B_0DJl2kuzoNRTEtQmx0SjJYZXc)
|
||||
@@ -72,12 +74,15 @@ Questions to ask:
|
||||
* Use the VM detonation service to capture any network connections or packet data.
|
||||
* If you can't do this then we will need to dynamically debug the malware.
|
||||
|
||||
---
|
||||
|
||||
## Malware Analysis Report
|
||||
|
||||
You will want to capture this information throughout your investigation either through notes or report documents.
|
||||
|
||||
You can use the **Malware Analysis Report** template [HERE](https://securedorg.github.io/ReportForm.html)
|
||||
|
||||
---
|
||||
|
||||
## LAB 1
|
||||
|
||||
|
||||
Reference in New Issue
Block a user