Tag Archives: analysis
Yara Signatures

How to Write Simple but Sound Yara Rules – Part 2

Months ago I wrote a blog article on „How to write simple but sound Yara rules„. Since then the mentioned techniques and tools have improved. I’d like to give you a brief update on certain Yara features that I frequently use and tools that I use to generate and test my rules. (mehr …)

6 Comments Continue Reading →
DLL in Sandbox

Smart DLL execution for Malware Analysis in Sandbox Systems

While analysing several suspicious DLL files I noticed that some of these files (which were obviously malicious) didn’t perform their malicious activity unless a certain function was triggered. The malware used a registry entry to execute a certain function that is exported by the DLL called „InstallM“. I had to run „rundll32.exe malware.dll,InstallM“ to trigger […]

3 Comments Continue Reading →
Checkpoint Top Speaker Analysis

Checkpoint Firewall Support und Fehleranalyse mit dem fw.log

Die Erfahrung hat gezeigt, dass es im Umfeld von Checkpoint Firewalls immer wieder dazu kommen kann, dass Firewalls ohne ersichtlichen Grund Anzeichen einer Überlastung aufweisen, indem sie für kurze Zeit nicht mehr erreichbar sind und Verbindungen mit Timeouts abbrechen. Besonders in großen Firewall-Umgebungen, mit mehreren Gigabyte an Logdaten pro Tag, stellt die Analyse derart unbestimmter […]

Leave a comment Continue Reading →