Week of Data Dumps, Part 1 – device names July 21, 2022 in Archaeology, Clustering, Fi... 2022-7-22 05:5:35 | 阅读: 32 | 收藏 | www.hexacorn.com windows islands proximity atoms collecting

Shall we say… Good bye, phishing queue? Imagine you stop processing your phishing reports today.Just stop.What could be... 2022-7-8 06:19:33 | 阅读: 45 | 收藏 | www.hexacorn.com phishing bulk phish analysis security

DriverPack – Clean PDB paths July 2, 2022 in Archaeology, File Formats ZO... 2022-7-3 05:43:13 | 阅读: 37 | 收藏 | www.hexacorn.com analysis download applicable 32gb bonus

Da Li’L World of DLL Exports and Entry Points, Part 5 July 1, 2022 in Archaeology, File Formats ZO... 2022-7-2 06:3:57 | 阅读: 37 | 收藏 | www.hexacorn.com ruleset enhance zoo fashion

This post mentions many file extensions What are Windows file extensions of interest ? Is there a single superset of all pos... 2022-7-1 07:3:8 | 阅读: 41 | 收藏 | www.hexacorn.com comma delimited extracting scr bh

A few more protocol handlers :) June 7, 2022 in Archaeology, Windows 10, Win... 2022-6-8 05:40:9 | 阅读: 107 | 收藏 | www.hexacorn.com windows msime win11 insightsms

Not installing the installers, part 3 June 5, 2022 in Archaeology, Batch Analysis,... 2022-6-6 00:38:35 | 阅读: 29 | 收藏 | www.hexacorn.com installers avenue archaeology clustering du

Not installing the installers, part 2 May 22, 2022 in Archaeology, Batch Analysis,... 2022-5-23 05:5:21 | 阅读: 36 | 收藏 | www.hexacorn.com analysis goodware decompiled naive comparisons

Not installing the installers Looking at installers of goodware is quite boring. They do the right thing, at least mos... 2022-5-22 06:22:25 | 阅读: 40 | 收藏 | www.hexacorn.com installers software exclusion combing

Hijacking HijackThis May 20, 2022 in Archaeology, Batch Analysis,... 2022-5-21 05:46:38 | 阅读: 46 | 收藏 | www.hexacorn.com analysis processes clsids software download

Infosec Salaries – the myth and the reality Every once in a while someone drops a salary bomb discussion on social media and the spe... 2022-4-22 07:0:33 | 阅读: 25 | 收藏 | www.hexacorn.com salary rsus rsu vested refreshers

The Anti-VM trick that is kinda… personal April 16, 2022 in Anti-*... 2022-4-17 05:19:42 | 阅读: 48 | 收藏 | www.hexacorn.com handleuser novelty gist yeah

Good file… (What is it good for) Part 3 March 13, 2022 in GoodWare... 2022-3-13 09:2:46 | 阅读: 45 | 收藏 | www.hexacorn.com sampleset guids creations preliminary

Good file… (What is it good for) Part 2 This series talks about ‘good’ files. That is, files (samples) produced by reputable ven... 2022-3-12 07:9:51 | 阅读: 33 | 收藏 | www.hexacorn.com unpack 7z installers nullsoft universal

Good file… (What is it good for) Part 1 Most of (anti-) malware researchers focus on malware samples, because… it’s only natural... 2022-3-5 07:27:20 | 阅读: 30 | 收藏 | www.hexacorn.com reverse compilers guids artifacts goodness

Delphi API monitoring with Frida, Part 3 February 20, 2022 in Frida, Malware Analysis... 2022-2-21 03:14:44 | 阅读: 54 | 收藏 | www.hexacorn.com delphi processes represent offsets 4c48

Delphi API monitoring with Frida, Part 2 February 19, 2022 in Malware Analysis, Sandb... 2022-2-20 07:5:2 | 阅读: 78 | 收藏 | www.hexacorn.com delphi lstrlasg lstrasg monitoring

Analysing NSRL data set for fun and because… curious, Part 2 February 6, 2022 in Forensic Analysis, NSRL... 2022-2-7 06:38:6 | 阅读: 21 | 收藏 | www.hexacorn.com nsrl exclamation excluding substantial filenames

Analysing NSRL data set for fun and because… curious February 4, 2022 in Forensic Analysis, NSRL... 2022-2-5 06:45:30 | 阅读: 26 | 收藏 | www.hexacorn.com nsrl analysis hashset nsrlfile eh

Delphi API monitoring with Frida January 28, 2022 in Malware Analysis, Sandbo... 2022-1-29 06:39:30 | 阅读: 40 | 收藏 | www.hexacorn.com delphi rsold offsets decompiler