Turbo Unpacking: A Journey into Malicious Packers - Hacker Halted

More documents

Recommendations

Info

Y0da Crypt • Virtualization • Embedded virtual machine for selected functions • Obfuscations are used to make analysis more difficult • Compatible with other packers/protectors Dot Fake Signer Code Virtualizer
With compression <strong>Packers</strong> UPX Protectors ASProtect Bundlers MoleBox • <strong>Packers</strong> • Single or multiple code layers • Multiple compression algorithms in use • aplib, lzma, lzss, lzrw, lzbrs, ffce, jcalg,… • Custom PECOFF table processing • Imports are usually* compressed • Resources are usually* compressed • Relocations are usually* compressed • TLS can be emulated • Can pack x86/x64/.net files • No anti-reversing protection – * If present and selected by the user
Page 1 and 2: Turbo unpacking: A Journey into Mal
Page 3 and 4: Introduction to « Packers » PECOF
Page 5: Y0da Crypt Dot Fake Signer • Obfu
Page 9 and 10: With compression Packers UPX Protec
Page 11 and 12: Standard packed File layout • Ori
Page 13 and 14: Challenges of Malicious Packers •
Page 15 and 16: Case Study : Hflux • Peer 2 Peer
Page 17 and 18: Case Study : CodecPack • Advertis
Page 19 and 20: Conclusion • Don’t bother •

Turbo Unpacking: A Journey into Malicious Packers - Hacker Halted

Create successful ePaper yourself

Delete template?

Save as template?