Turbo Unpacking: A Journey into Malicious Packers - Hacker Halted

ePAPER READ

DOWNLOAD ePAPER

hackerhalted.com

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

START NOW

Challenges of Malicious Packers

• Highly polymorphic (server side)

• Anti Emulation

• Anti Sandboxing

• Anti Debugging

• Crazy code flow : Code moved around the

heap

• Long to trace till the end

Weaponizing Lisp - John Kanen Flowers - Hacker Halted

Battery Firmware Hacking - Hacker Halted

DIY SCADA Security - Learn how to build your own ... - Hacker Halted

Blackberry Proof-of-Concept: Malicious Applications - Hacker Halted

Exploiting the Top 10 Database Vulnerabilities and ... - Hacker Halted

Cyber Forensics in the Cloud - Hacker Halted

How to gain access to computers and virtual machines - Hacker Halted

FedRAMP – How the Feds Plan to Manage Cloud - Hacker Halted

Hackers Can Kill You - Majid Sarrafzadeh - Hacker Halted

Penetration Testing in a Virtualized Environment - Hacker Halted

TRAINING CLASS CHANGE REQUEST FORM - Hacker Halted

Malicious « packed » File layout • Original file layout • Packed file layout DOS PE Sections (code, data, imports) (Embedded in encrypted form) DOS PE Sections (code, data, imports) Resources Overlay Resources Encrypted File Overlay

Challenges of Malicious Packers • Highly polymorphic (server side) • Anti Emulation • Anti Sandboxing • Anti Debugging • Crazy code flow : Code moved around the heap • Long to trace till the end

Page 1 and 2: Turbo unpacking: A Journey into Mal
Page 3 and 4: Introduction to « Packers » PECOF
Page 5 and 6: Y0da Crypt Dot Fake Signer • Obfu
Page 7 and 8: With compression Packers UPX Protec
Page 9 and 10: With compression Packers UPX Protec
Page 11: Standard packed File layout • Ori
Page 15 and 16: Case Study : Hflux • Peer 2 Peer
Page 17 and 18: Case Study : CodecPack • Advertis
Page 19 and 20: Conclusion • Don’t bother •

Turbo Unpacking: A Journey into Malicious Packers - Hacker Halted

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?