Learn what really matters by an actual analyst: malware reversing, clean vs malware, report writing, unpacking

This article discusses an interesting tactic (CVE-2020-1464) actively used by different Java RAT malware authors like Ratty & Adwind to distribute malicious JAR appended to signed MSI files.

Learn the tools and techniques that can help you identify and analyze malicious PDF files - start at 15:16 to jump into the details about static and dynamic ...

What started as a false positive alert for a Microsoft signed file turns out to be a WFP application layer enforcement callout driver that redirects traffic to a Chinese IP. How did this happen?

When facing a ransomware infection, it helps to be familiar with some tools as well as key points to identify ransomware correctly.

An introduction to Ghidra's primary components and the information they provide

I explain the basic structure of the Portable Executable file format using animated graphics. This video is meant for beginners in malware analysis.My malwar...

We use abstract syntax tree manipulation, regex search and replace and dynamic analysis to deobfuscate and unpack GootLoader. Each method has its own pros an...

This video has a newer, updated version here: https://youtu.be/k2gzFV2-czcI tried three free disassemblers and decompilers and a paid one, namely IDA Free, G...

We create a C2 extractor for APT malware Kopiluwak. For that we need to unpack two layers of code (JScript, VBA) and remove the slight obfuscation. The sampl...

This is an overview to common process injection techniques used by malware, including AtomBombing, Process Hollowing aka RunPE, Process Doppelgänging.My malw...

PDF | The PE format is complex and robust PE parsing must consider the behaviour of all 32- and 64-bit Windows operating systems. It is unpredictable... | Find, read and cite all the research you...

I showcase a minimal FASM sample that prevents memory dumping. It erases its own header in memory so that dumping tools don't see a valid PE image anymore.My...

EternalPetya has more than 10 different names. Many do not realize that CryptoLocker is long dead. These are not isolated cases but symptoms of a systemic problem: The way we name malware does not...

Course link: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?referralCode=EE0E2DC9FA7388FF25B7Follow me on Twitter: ht...

Researchers develop an AI with a 98% malware detection rate and 5% false positive rate. If you think this is a splendid technology for antivirus software, this article might change your mind.

This blog is a continuation of our blog series on the Emotet banking Trojan. So far, we have analysed Emotet’s delivery mechanism and its behaviour through dynamic analysis. The host and network data...

I describe three ways to find or get fresh malware samples if you have no access to Virustotal or other paid accounts. As a bonus we deobfuscate a small powe...

An overview to unpacking methods, when to apply them and what generic approach to use for unpacking malware.Malware Course: https://www.udemy.com/course/wind...

An explanation of the impossibility to detect malware perfectly including a dive into Fred Cohen's proof that virus detection is an undecidable problem.Compu...

We use the emulator Speakeasy by Mandiant to aid in analysis of kernel mode drivers and user mode malware.My malware analysis course for beginners: https://w...

Everyone who deals with malware, whether they are writing about it, helping to get rid of it, testing Antivirus products, or analyzing samples, will know this: Malware names are a convoluted mess. AV...

My opinion about the book "Malware Analysis and Detection Engineering" by Abhijit Mohanta and Anoop Saldanha.My malware analysis course for beginners: https:...

We look at two ways to unpack malware that was crypted with an AutoIt packer. At first we trick our way to the payload, skipping the AutoIt script altogether...

Ghidra makes scripting very easy. Here it helps us to deobfuscate strings in a NightHawk malware sample.My malware analysis course for beginners: https://www...

A phishing attempt with an unusual archive format named ZPAQ leads to an interesting malware downloader. We debloat the sample and decrypt the downloaded .wa...

We create a .NET executable that hides code from decompilation and debugging with DnSpy by using a technique called R2R Stomping. Afterwards we explore how t...

Dark Mode: https://github.com/zackelia/ghidra-darkIDA Key Bindings: https://github.com/nullteilerfrei/reversing-class

Contribute to struppigel/hedgehog-tools development by creating an account on GitHub.

We create YARA rules and scan files with the YARA signature scanner.My malware analysis course for beginners: https://www.udemy.com/course/windows-malware-an...

This is the sample that we unpacked in the previous episode. It is obfuscated with .NETReactor. We use Shed to obtain decrypted strings and get an idea of wh...