The Anti-VM trick that is kinda… personal April 16, 2022 in Anti-*... 2022-4-17 05:19:42 | 阅读: 48 | 收藏 | www.hexacorn.com handleuser novelty gist yeah

Good file… (What is it good for) Part 3 March 13, 2022 in GoodWare... 2022-3-13 09:2:46 | 阅读: 45 | 收藏 | www.hexacorn.com sampleset guids creations preliminary

Good file… (What is it good for) Part 2 This series talks about ‘good’ files. That is, files (samples) produced by reputable ven... 2022-3-12 07:9:51 | 阅读: 33 | 收藏 | www.hexacorn.com unpack 7z installers nullsoft universal

Good file… (What is it good for) Part 1 Most of (anti-) malware researchers focus on malware samples, because… it’s only natural... 2022-3-5 07:27:20 | 阅读: 30 | 收藏 | www.hexacorn.com reverse compilers guids artifacts goodness

Delphi API monitoring with Frida, Part 3 February 20, 2022 in Frida, Malware Analysis... 2022-2-21 03:14:44 | 阅读: 54 | 收藏 | www.hexacorn.com delphi processes represent offsets 4c48

Delphi API monitoring with Frida, Part 2 February 19, 2022 in Malware Analysis, Sandb... 2022-2-20 07:5:2 | 阅读: 78 | 收藏 | www.hexacorn.com delphi lstrlasg lstrasg monitoring

Analysing NSRL data set for fun and because… curious, Part 2 February 6, 2022 in Forensic Analysis, NSRL... 2022-2-7 06:38:6 | 阅读: 21 | 收藏 | www.hexacorn.com nsrl exclamation excluding substantial filenames

Analysing NSRL data set for fun and because… curious February 4, 2022 in Forensic Analysis, NSRL... 2022-2-5 06:45:30 | 阅读: 26 | 收藏 | www.hexacorn.com nsrl analysis hashset nsrlfile eh

Delphi API monitoring with Frida January 28, 2022 in Malware Analysis, Sandbo... 2022-1-29 06:39:30 | 阅读: 40 | 收藏 | www.hexacorn.com delphi rsold offsets decompiler

Dexray v2.32 Dexray v2.32January 23, 2022 in DeXRAY, Soft... 2022-1-23 08:7:44 | 阅读: 21 | 收藏 | www.hexacorn.com dexray oskar decrypting naively deender

Beyond good ol’ Run key, Part 138 January 23, 2022 in Autostart (Persistence)... 2022-1-23 08:3:46 | 阅读: 32 | 收藏 | www.hexacorn.com peerdist autostart wininet internally library

Beyond good ol’ Run key, Part 137 January 22, 2022 in Autostart (Persistence)... 2022-1-22 09:8:59 | 阅读: 24 | 收藏 | www.hexacorn.com library lui windows autostart

Yara Carpet Bomber, Part 2 January 18, 2022 in Yara sigs... 2022-1-19 07:15:26 | 阅读: 17 | 收藏 | www.hexacorn.com steve bomber dllgdi32 dllmpr

Beyond good ol’ Run key, Part 136 January 18, 2022 in Autostart (Persistence),... 2022-1-19 03:23:9 | 阅读: 18 | 收藏 | www.hexacorn.com winword wwlibt powerpoint software microsoft

Yara Carpet Bomber January 16, 2022 in Yara sigs... 2022-1-16 23:50:25 | 阅读: 19 | 收藏 | www.hexacorn.com eng yar slowing windows x00p

ms-cxh and ms-cxh-full handlers January 16, 2022 in Archaeology, Uncategoriz... 2022-1-16 18:46:58 | 阅读: 598 | 收藏 | www.hexacorn.com cxh frx dialog windows moset

Windows Installation animation January 16, 2022 in Archaeology, Windows 10,... 2022-1-16 18:4:24 | 阅读: 38 | 收藏 | www.hexacorn.com windows animation oobe

Beyond good ol’ Run key, Part 135 January 16, 2022 in Autostart (Persistence)... 2022-1-16 17:50:49 | 阅读: 27 | 收藏 | www.hexacorn.com windows oobe yesterday exewinsetup

Putting .inf files and NSRL database to a better use When you look at a large repository of clean files there is always an opportunity to fin... 2021-12-26 07:8:41 | 阅读: 26 | 收藏 | www.hexacorn.com software nsrl productcode clusters

Mapping Chrome extension IDs to their names December 24, 2021 in Chrome, Forensic Analys... 2021-12-25 07:35:1 | 阅读: 26 | 收藏 | www.hexacorn.com chrome analysis weird coined