New answers tagged malware
0
Here are some links you may find helpful:
https://github.com/goliate/hidden-tear
https://github.com/mauri870/ransomware
PDF, containing some interesting links
You can also look for MSIL binaries, deobfuscate using de4dot and decompile using dnSpy. If sample is not strongly protected, you will get output as readable as the source code.
0
Try running the following from the command line:
cscript /x .\malwaresample.vbs
That should open it up in Visual Studios and allow you to step through it.
1
Nobody is going to publish their source code for active ransomware, there are various reasons for that:
Its a business and the author makes money from it, and by giving away the source code there is a competitor. Of course that is not wanted
It is possible that someone will find weaknesses, obviously that is possible for binaries aswell but usually it's ...
0
You cannot do that with dnSpy, as the code that is stored in array is not managed code but native. So you have to extract that bytes, saved them in a file and analyze spearately with a native disassembler like r2, Ghidra, IDA etc.
As for stepping into, it's the same. You have to use a native debugger and not the one from dnSpy.
Since this is a mixed binary ...
4
the last byte of API/library call instructions is always 0x0A
It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A.
Having bytes of the call like this 280600000A let's go one by one.
0x28 - is the value for opcode 'call' and it takes one operand.
the rest of the opcode is the metadata ...
Top 50 recent answers are included
