Turbo Unpacking: A Journey into Malicious Packers - Hacker Halted

More documents

Recommendations

Info

Malware <strong>Packers</strong> shadow’s pack Obfuscators pohernah Bundlers p0ke Crypt • “Custom” packers • <strong>Packers</strong> • Multiple versions (per request) • High use of polymorphism • Usually simple memory overwrites • Obfuscators • Multiple versions (per request) • Highly obfuscated entry point • Bundlers • Usually simple overlay packers
Standard packed File layout • Original file layout • Packed file layout DOS PE Sections (code, data, imports) (compression) DOS PE Sections Resources Resources Overlay STUB Overlay
Page 1 and 2: Turbo unpacking: A Journey into Mal
Page 3 and 4: Introduction to « Packers » PECOF
Page 5 and 6: Y0da Crypt Dot Fake Signer • Obfu
Page 7 and 8: With compression Packers UPX Protec
Page 9: With compression Packers UPX Protec
Page 13 and 14: Challenges of Malicious Packers •
Page 15 and 16: Case Study : Hflux • Peer 2 Peer
Page 17 and 18: Case Study : CodecPack • Advertis
Page 19 and 20: Conclusion • Don’t bother •

Turbo Unpacking: A Journey into Malicious Packers - Hacker Halted

Create successful ePaper yourself

Delete template?

Save as template?