Palo Alto Networks

shellcode

Pythons and Unicorns and Hancitor…Oh My! Decoding Binaries Through Emulation

This blog post is a continuation of my previous post, VB Dropper and Shellcode for Hancitor Reveal New Techniques Behind Uptick, where we analyzed a new Visual Basic (VB) macro dropper and the accompanying shellcode. In the last post, we left off with having successfully identified where the shellcode carved out and decoded a binary from the Microsoft Word document.

Often when analysts are faced with an embedded payload for which they want to write a decoder, they ...

Malware

Unit 42

Aug 30, 2016

By Jeff White

Palo Alto Networks

Products and Services

Partners

Cybersecurity

Exploitation Demystified, Part 3: Heap-Based Exploits

In my previous blog post in the Exploitation Demystified series, we learned how memory corruption exploits are implemented using stack-based overflow vulnerabilities. Let’s talk now about a main alternative pat...

Apr 13, 2016

By Palo Alto Networks

Cybersecurity

Exploitation Demystified, Part 2: Overwrite and Redirect

In Part 1 of this series, we laid the foundation of memory corruption exploitation and presented the basic exploitation framework:

Dec 01, 2015

By Palo Alto Networks

Cybersecurity

Exploitation Demystified: Why, What and How, Part 1

Exploits have been the major enabler of advanced persistent threats for over a decade now, but it is only in the recent years that the term has become widely used and acknowledged as a main attack vector.

Nov 02, 2015

By Palo Alto Networks

Malware, Threat Prevention, Unit 42

UPS: Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload

A June 23 FireEye blog post titled “Operation Clandestine Wolf” discussed a cyber espionage group, known as APT3, that had been exploiting a zero-day...

Jul 27, 2015

By Robert Falcone and Richard Wartell

Endpoint, Threat Prevention, Unit 42

Addressing CVE-2014-6332 SWF Exploit

Continuing a recent trend in which Internet Explorer vulnerabilities are exploited using Flash, samples of an SWF purportedly used in conjunction with CVE-2014-6332 have appeared in several places. The most famous examples of this trend are...

Nov 26, 2014

By Palo Alto Networks

Load more blogs