PE EXPLORER OVERRIDE DELETE SECTION WINDOWS 10
PE EXPLORER OVERRIDE DELETE SECTION PRO
PE EXPLORER OVERRIDE DELETE SECTION WINDOWS

Using PEview we can see the virtual size is close to the raw size of the files. Using PEiD we can identify them as being compiled with Microsoft Visual C++ 6.0. No, thereвЂ™s no indicators these files are packed or obfuscated due to the following: Lab01-01.dll compile time - Sunday 16:16:38 UTC Question 3ДЄre there any indications that either of these files is packed or obfuscated? If so, what are these indicators? Answer 3 Lab01-01.exe compile time - Sunday 16:16:19 UTC The information is found under: IMAGE_NT_HEADERS > IMAGE_FILE_HEADER > Time Date Stamp Using PEview we are able to view this information. At the time of writing both matched existing antivirus signatures: Using the Malcode Analyst Pack we are able to perform this by simply right clicking the files and selecting VirusTotal. Does either file match any existing antivirus signatures? Answer 1 Upload the files to and view the reports. Use the tools and techniques described in the chapter to gain information about the files and answer the questions below.

This lab uses the files Lab01-01.exe and Lab01-01.dll. This details analysis undertaken and answers to the lab questions in Chapter 1.

PE EXPLORER OVERRIDE DELETE SECTION WINDOWS

In this instance a single Windows XP VM was used through Vmware Workstation instead.

Virtualbox has been used for virtualisation, except in cases where Vmware was required to complete the questions (Chapter 17).

PE EXPLORER OVERRIDE DELETE SECTION WINDOWS 10

The Windows 10 and Windows 7 VMs were setup with FLARE VM, with the Windows XP machine loaded just with the tools required, and the SIFT Workstation being used solely for generating Yara rules as extra bonus content.

This has been completed using 3 windows VMs (Windows XP 32-bit, Windows 7 32-bit, Windows 10 64-bit), a pfSense box, and an instance of SIFT Workstation however, you really only need a couple of VMs (32-bit and 64-bit) so long as they have Python installed and the tools used (including Snort).

In some instances Ghidra has been used where scripting or extensions were required and only available in a paid version of IDA Pro.

PE EXPLORER OVERRIDE DELETE SECTION PRO

The term IDA and IDA Pro have been used interchangeably here and are used to reference IDA Pro Freeware Version v5.0, in addition variants of вЂxrefsвЂ™ have also been used to mean вЂcross-referencesвЂ™.This is most common with DLLs, and if it occurs your address will have been rebased.

If your addresses donвЂ™t match those outlined here itвЂ™s because a program is running that is using the desired base address of the binary in question.

Special thanks to No Starch Press for the shout-out of this post, and to both Michael Sikorski and Andrew Honig for their permission to create this blog post based on the material and exercises contained within вЂPractical Malware AnalysisвЂ™. I would thoroughly recommend purchasing this book. This is a very informative book to learn about malware analysis and comes with a number of binaries to test your reverse engineering skills. This details reverse engineering activities and answers for labs contained in the book вЂPractical Malware AnalysisвЂ™ by Michael Sikorski, and Andrew Honig, which is published by No Starch Press. Practical Malware Analysis - Lab Write-up

Pe explorer override delete section