Главная
Study mode:
on
1
Intro
2
AV Problem
3
Marketing Problem
4
Missing Criteria
5
Researcher's Problem
6
Incident Responder's Problem
7
Sample Identification
8
Locating Associated Samples
9
Shared Engines
10
Development Methods
11
Vendors with Usable Results
12
Boiling Down Results
13
ATT&CK & Granularity
14
SEH Variation
15
Malpedia
16
Malware Classification Systems
17
Some Hashes
18
Exif metadata
19
Code Signing Certificate
20
Abused Certificates
21
PE Metadata
22
Sections
23
Resources
24
Document Metadata
25
Filenames
26
URL Structure: Download
27
URL Structure: C2
28
Mutual Exclusion (Mutex)
29
Registry key
30
Algorithms
31
Infosec Finer Things
32
Diamond Model
33
Control Flow Graph Analysis
34
Schema: STIX
35
JSON for Linking Data: JSON-LD
36
RDF N-Quad
37
Graph Tools: Graph Databases
38
Network Graph
Description:
Explore techniques for comparing malicious files in this 56-minute conference talk from BSides Charm 2019. Delve into the challenges faced by researchers and incident responders when dealing with malware samples. Learn about sample identification, locating associated samples, and analyzing shared engines. Discover various malware classification systems, including MITRE ATT&CK and Malpedia. Examine methods for extracting and comparing metadata, such as Exif data, code signing certificates, PE metadata, and document properties. Investigate techniques for analyzing URL structures, mutex objects, registry keys, and algorithms. Gain insights into advanced analysis methods like control flow graph analysis and explore data representation formats like STIX and JSON-LD. Conclude with an overview of graph databases and network graph tools for visualizing malware relationships.

Comparing Malicious Files

Add to list
0:00 / 0:00