Dliv3

layout	title	date	categories	permalink
post	Thoughts about automated malware unpacking	2020-05-08 17:00:00 -0700	reverse-engineering malware-analysis	/posts/automated-malware-unpacking

Probably most of the malwares out there use some sort of packer to evade detection and classification or to make the post-analysis more difficult. So in this blog post, I will talk about one of the most-used packing techniques and how to SOMETHING_ELSE(defeat packers/ should edit) that with the power of binary emulation. Also, I'll drop a PoC of the new project that I'm working on.

	$machineAccountQuotaComputers = Get-ADComputer -filter {ms-DS-CreatorSID -ne "$null"} -Properties ms-DS-CreatorSID,Created

	foreach ($machine in $machineAccountQuotaComputers) {
	$creator = $null
	try {
	$creator = [System.Security.Principal.SecurityIdentifier]::new($machine.'ms-DS-CreatorSID').Translate([System.Security.Principal.NTAccount]).Value
	}
	catch {
	$creator = $machine.'ms-DS-CreatorSID'
	}

	var details = {
	displayItems: [
	{
	label: "Original donation amount",
	amount: { currency: "USD", value : "65.00" },
	},
	{
	label: "Friends and family discount",
	amount: { currency: "USD", value : "-10.00" },
	pending: true

	/*

	This file contains definitions used by the Hex-Rays decompiler output.
	It has type definitions and convenience macros to make the
	output more readable.

	Copyright (c) 2007-2017 Hex-Rays

	*/

	def dliveDebugStr(string):
	print('\033[32m[DLIVE DEBUG] >>> {}\033[0m'.format(string))

	def dliveDebugFunc(func):
	def wrapper(args, *kw):
	dliveDebugStr('{}.{}'.format(args[0].__class__.__name__, func.__name__))
	# for each in args:
	# dliveDebugStr('\| -- {}'.format(each))
	# for i in kw:
	# dliveDebugStr('\| -- {} => {}'.format(i, kw[i]))

	#!/usr/bin/env python
	####################
	#
	# Copyright (c) 2019 Dirk-jan Mollema / Fox-IT (@_dirkjan)
	#
	# Permission is hereby granted, free of charge, to any person obtaining a copy
	# of this software and associated documentation files (the "Software"), to deal
	# in the Software without restriction, including without limitation the rights
	# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	# copies of the Software, and to permit persons to whom the Software is

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/types.h>
	#include <sys/socket.h>
	#include <netinet/in.h>

	#define SERVER_PORT 9999

	int main() {

	# coding=utf-8
	"""
	LICENSE http://www.apache.org/licenses/LICENSE-2.0
	"""
	import datetime
	import sys
	import time
	import threading
	import traceback
	import SocketServer

	package main

	import (
	"fmt"
	"log"
	"strconv"

	"github.com/miekg/dns"
	)

	md5 cd253e822337a58c6f4f65c08a789e0c
	sha256 efb0e6065bd9ab440b959553eca5389c2073e5da1f006f6d9aaa1af424a66303

Dliv3

Background