Skip to main content

Posts

Showing posts from January, 2022

Anti-Malware Application for the android system

  on Anti-Malware Application for the android system Agenda: 1-the architecture of the anti-malware application 2-detecting malware based on a hash of the application how to detect based on hash How to update the firebase database automatically using Twitter API. With malware hashes that were detected recently. 3-Detecting based on deep learning dataset DL model integrating the DL model with android using FLASK server 4-conclusion Introduction 0xbyte is an anti-malware application that has built on two detection techniques (detecting based on the hash of application- detection based on the permissions of applications, using deep learning ). This project has built by combining two programming languages (Python-Java). this is the link of GitHub for the project: https://github.com/M-khalifa1/Anti-malware-detection-app. 1-the architecture of the anti-malware application ِAs we Showed in The below image, the architecture of the application was built .on two techniques. The first is detectin

Unpacking MZP Ransomware manually using tail jump

  Post author on Unpacking MZP Ransomware manually using tail jump Malware authors use many of tricks to prevent analysis for security researchers and evade Antiviruses. One of the most technique used,it is a packer. What is the packer? It’s a software or tool for compressing programs or malware by obfuscating the content of executable file and generate a new executable file in packed structure. Why is unpacking malware important? Because you cannot analysis malware without unpacking and deobfuscating strings to be readable. How to the unpack happen ? As we see in the image OS create stub code with packed file What is stub code ? Stub code is responsible for unpacking packed sections, when you are running the file ,the address of unpack file exists in the stub code to unpack file. So at the end of the stub code we will see an unconditional jump (tail jump), that is meant after execute the stub code will jump to the address of unpacking file. How to identify type of the packer? There ar