Posts

Assembly Language Basic

Image
  Bit - This is the smallest piece of data. It can be a 0 or 1 or Off or ON. Byte - a byte is 8 bits. It has a range of equivalent decimal values of 0 to 255 Word - a word is two bytes together or 16 bits Double Word - a double word is tow words or 32 bits Kilobyte - a kilobyte is 1024 (32 * 32) bytes Megabyte - a megabyte is is 1,048,578 bytes (1024 x 1024). Regsitry: These registers are; EAX - Extended Accumulator Register EBX - Extended Base Register ECX - Extended Counter Register EDX - Extended Data Register ESI - Extended Source Index EDI - Extended Destination Index EBP - Extended Base Pointer ESP - Extended Stack Pointer EIP - Extended Instruction Pointer Flags Flags are a single bit that indicates status of a register. The flag register on modern 32 bit CPU's is 32 bits long. There are 32 flags. In our studies here, we will only need three of them; (1) the Z flag, the O flag and the C flag. A flag can only be SET or NOT SET Z-Flag The...

Malware Sample Analysis (29F228F3375C489A8A6E31203AB25787)

Image
File hash: MD5 : 29F228F3375C489A8A6E31203AB25787 Sha1 : 14D713A5C8A2FC01FA2F01D993A249B9FB292810 Sha256: EC905CB2CB8E9F74790ADDE2C138807F3A6CDBECD5735FA5035B547280D7DB79 Note : cmd are mentioned in blue.Imp data marked as "purple". Basic Static Analysis: Determine the file type: Using file command:   test$ file Unknown Unknown: PE32 executable (console) Intel 80386, for MS Windows Using File Signature: Test$ hexdump Unknown  0000000 5a4d 0090 0003 0000 0004 0000 ffff 0000 0000010 00b8 0000 0000 0000 0040 0000 0000 0000 0000020 0000 0000 0000 0000 0000 0000 0000 0000 0000030 0000 0000 0000 0000 0000 0000 00d8 0000 0000040 1f0e 0eba b400 cd09 b821 4c01 21cd 6854 0000050 7369 7020 6f72 7267 6d61 6320 6e61 6f6e 0000060 2074 6562 7220 6e75 6920 206e 4f44 2053 0000070 6f6d 6564 0d2e 0a0d 0024 0000 0000 0000 0000080 4be3 9a53 2aa7 c93d 2aa7 c93d 2aa7 c93d 0000090 b7bc c9a3 2aa6 c93d b7bc c997 2aa1 c93d 00000a0 52ae c9ae 2aa2 c93d 2aa7 c93c 2ab5 c93d 00000b0 b7bc c992 2aa6 c93d ...