Videos
Sysinternals Programi 1 - TCPView
TCPView pokazuje procese koji ostvaruju konekcije preko mreze. U njegovoj listi se u realnom vremenu moze gledati ono sto se ...
Discover an IP address using TCPview utility
This process will allow you discover the actual server IP address that your trading application uses using the Microsoft ...
Mit TCP View oder ohne Tools Spyware finden -Tutorial [German/Deutsch] 2015
Mit TCP View oder ohne Tools Spyware finden -Tutorial [German/Deutsch] 2015 Link TCP View: ...
Documents
ma5.html MALWARE ANALYSIS - PART 5 MD5 of the available file ...
http://handlers.sans.org/pbueno/ma5.html MALWARE ANALYSIS - PART 5 MD5 of the available file: ecd45b584f7a1e50bb044646f4abb0be Name of the file: cretzu.exe-orig-ecd45b584f7a1e50bb044646f4abb0be MD5 of the zip file with password [infected]= ecd45b584f7a1e50bb044646f4f3ll3t http://handlers.sans.org/pbueno/cretzu.exe.zip
1. Is this file packed? If so, which packer? Yes, it was first packed with UPX; running strings against the cretzu.exe file shows the header of the UPX packer: "UPX0 UPX1" testing cretzu.exe-orig-ecd45b584f7a1e50bb044646f4abb0be [OK] MD5 of the packed file=ecd45b584f7a1e50bb044646f4abb0be MD5 of the unpacked file=74e52f90026f6d2c39f73649b9854221 Size of the packed file=849,319 Size of the unpacked file=894,375 Using the upx packer you can verify the file as an upx file and uncompress it. Doing the same against the uncompressed file shows it is compressed with rar "WinRAR SFX", using rar to test the file shows all files that are going to be found later on the infected system:
Testing archive ...
