RSS Amplifier

Projects on Arch Cloud Labs · Nov 13, 2022

Analysis of a LoadLibraryA Stack String Obfuscation Technique with Radare2 & x86dbg

Read inOriginalenesdefrptjaittr
0
Sign in to vote or save

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

About the Project Today, we’re going to analyze a malicious binary recently identified by Arch Cloud Labs malware collection system “Archie”. This binary leverages the LoadLibraryA function to resolve DLLs at run time for additional functionality. Malware samples typically do this to ensure there’s limited information in the import table in an attempt to avoid triggering…

About the Project Today, we’re going to analyze a malicious binary recently identified by Arch Cloud Labs malware collection system “Archie”. This binary leverages the LoadLibraryA function to resolve DLLs at run time for additional functionality. Malware samples typically do this to ensure there’s limited information in the import table in an attempt to avoid triggering static rule detection, or evade EDR products. This particular sample struct me as interesting because of the stack string obfuscation method used which Ghidra did not disassemble correctly.

Read on /projects/loadlibrary-analysis/ ↗

Comments

Nothing yet. Say the first thing.

    Sign in to join the conversation.