diff --git a/static.md b/static.md index afbe2cc..39e8329 100644 --- a/static.md +++ b/static.md @@ -13,6 +13,7 @@ Static analysis is like reading a map for directions on where to go. As you foll This section will teach you how to jump into code in static disassembly then rename and comment on interesting assembly routines that we will debug in **Section 6**. +--- ## LAB 2 @@ -126,7 +127,8 @@ Let's use the tool **XORSearch** to see if we can find some interesting xor deco Let's navigate to the start of the program using the **X** key. Use the spacebar to toggle between graph view and text view. -![alt text](https://securedorg.github.io/images/static7.gif "start function") +*Click Image to Enlarge* +[![alt text](https://securedorg.github.io/images/static7.gif "start function")](https://securedorg.github.io/images/static7.gif) It's easy to trace back through the program disassembly, but let's look at some control flow assembly instructions. Remember **jmp, jne, jnz, jnb** are control flow functions. diff --git a/triage.md b/triage.md index 589cce1..02d8ba6 100644 --- a/triage.md +++ b/triage.md @@ -24,6 +24,8 @@ This checklist should get you started: - Quick VM Detonation - Capture network information +--- + ## Download the Unknown Malware [**HERE**](https://drive.google.com/open?id=0B_0DJl2kuzoNRTEtQmx0SjJYZXc) @@ -72,12 +74,15 @@ Questions to ask: * Use the VM detonation service to capture any network connections or packet data. * If you can't do this then we will need to dynamically debug the malware. +--- + ## Malware Analysis Report You will want to capture this information throughout your investigation either through notes or report documents. You can use the **Malware Analysis Report** template [HERE](https://securedorg.github.io/ReportForm.html) +--- ## LAB 1