ファイルベースのサンドボックスの回避
|
|
|
- せいごろう ひらみね
- 9 years ago
- Views:
Transcription
1
2 VMware FireEye 18 1
3 FireEye? API iframe DLL VMware VMware VMX 2
4 1 C&C FireEye UpClicker UpClicker C&C APT Advanced Persistent Threat RAT Poison Ivy 4 1 UpClicker 0Eh SetWinodwsHookExA Windows WH_MOUSE_LL 5 1 Gartner. Best Practices for Mitigating Advanced Persistent Threats. January FireEye. Don t Click the Left Mouse Button: Introducing Trojan UpClicker. December Symantec. Malware Authors Using New Techniques to Evade Automated Threat Analysis Systems. October ZDNet. Nitro targeted malware attacks hit chemical companies. November Microsoft. SetWindowsHookEx function. June
5 1 fn 1 fn 2 2 fn UnhookWindowsHookEx () sub_ () UpClicker 6 APT BaneChant FireEye. Trojan.APT.BaneChant: In-Memory Trojan That Observes for Multiple Mouse Clicks. April
6 Windows API MessageBox MessageBoxEx EXE DLL Adobe Acrobat PDF JavaScript for Acrobat API app.alert() 3 OK app.launchurl() URL 3 Web JavaScript Web URL API API Nap 7 Nap Microsoft Kaspersky 2011 Kelihos 8 7 FireEye. An Encounter with Trojan Nap. February Microsoft. Microsoft Neutralizes Kelihos Botnet, Names Defendant in Case. September
7 4 Nap Nap wowrizep.ru newbos2.exe HTTP 4 5 SleepEx() x0927C0 10 alterable false 10 5 SleepEx Nap 6
8 1 API NtDelayExecution() PDF JavaScript for Acrobat API app.settimeout() PDF 6 mystr() app.settimeout() mystr() 100 JavaScript for Acrobat API Hastati 9 Hastati Windows SystemTime API GetLocalTime() 7 SystemTime DD wyear wmonth wdayofweek wday 17 9 Vinay Pidathala, Yasir Khalid, et al. More Insights on the Recent Korean Cyber Attacks (Trojan.Hastati). March
9 7 Hastati GetLocalTime() Sleep() 0EA Sleep() 8 Sleep() 8
10 Microsoft PsSetCreateProcessNotifyRoutine Windows Windows PsSetCreateProcessNotifyRoutine Windows XP SP2 8 6 Pushdo Pushdo 10 Pushdo PsCreateProcessNotifyRoutine PsSetCreateProcessNotifyRoutine 9 IDA Windows ntoskrnl.exe PsSetCreateProcessNotifyRoutine x86 9 ntoskrnl.exe PsSetCreateProcessNotifyRoutine 10 Gunter Ollmann (Security Dark Reading). Much Ado About PushDo. May
11 Pushdo 10 Pushdo 1. NtBuildNumber Windows Windows XP PsSetCreateProcessNotifyRoutine 11 jmp_pssetcreateprocessnotifyroutine PsSetCreateProcessNotifyRoutine jmp jmp 2 PsSetCreateProcessNotifyRoutine jmp PsSetCreateProcessNotifyRoutine x57 0xBF 0xBF PspCreateProcessNotifyRoutine 4. PsCreateProcessNotifyRoutine Windows XP 0xBF mov edi 0x57 push edi 10 PsCreateProcessNotifyRoutine 11 jmp PsSetCreateProcessNotifyRoutine 10
12 Flash 12 Flash ActionScript Flash Player geturl() v GET Flash f.swf 12 Flash Flash Flash 11
13 PDF 13 JavaScript Acrobat Reader API app. viewerversion() Acrobat JavaScript GIF Flash iframe GIF Acrobat Flash HTML iframe GIF Flash 12
14 GIF GIF 1 GIF 0x3B GIF iframe GIF iframe Flash GIF Flash Web iframe 15 iframe Flash Flash HTML Flash iframe GIF 15 Flash iframe 13
15 DLL DLL run32dll.exe DLL DLL DLL VMware APT FireEye 11 VMware VMware VMware VMware vmicheatbeat vmci vmdebug vmmouse vmscis VMTools vmware vmx86 vmhgfs vmxnet 11 Virus Bulletin. Techniques for Evading Automated Analysis. February
16 17 RegOpenKeyExA() VMware RegOpenKeyExA() 17 RegOpenKeyExA() VMware VMware VMware 1 VMware 18 GetFileAttributeA() VMware 18 GetFileAttributeA() VMware GetFileAttributeA() cmp eax 0FFFFFFFh -1 vmmouse.sys VMware 15
17 VMX VMware VMX VMware I/O VMware 1. move eax, 'VMXh' 0x564D5868 EAX 2. EBX 3. ECX 0Ah VMware 4. DX VX VMware 5. in eax, dx EAX VMware 16
18 1 3 iframe FireEye Multi-Vector Virtual ExecutionTM MVX Flash/JPG iframe API VMware FireEye MVX 17
19 FireEye FireEye FireEye IPS FireEye FireEye Web 3 FireEye Fortune FireEye, Inc. All rights reserved. FireEye FireEye, Inc. RPT.HKTB.JA TEL: [email protected]
美唄市広報メロディー2014年1月号
1 2014 [email protected] January May September October November December February March June July August April BIBAI CITY INFORMATION http://db.net-bibai.co.jp/bibai/
2011上宮太子_高校_学校案内
UENOMIYA TAISHI SENIOR HIGH SCHOOL GUIDE BOOK 2011 www.uenomiya-taishi.ed.jp Curriculum Curriculum Letʼs enjoy school life at UT! 01 02 4 April 5 May 6 June 7 July 03 8 9 10 11 August September October
データシート / FireEye Network Security
FireEye Network Security FireEye Network Security Apple FireEye Network SecurityMulti-Vector Virtual Execution MVX Intelligence-Driven Analysis IDA 2 MVX IDA FireEye Network Security IPS OS E 10 Mbps 8
Copyright 2003 MapNet.Corp All rights reserved (1) V2.2 (2) (3) (4) (5) (6) 1 (7) (8) (9) 1/2500 1/250 1/10000 1/10000 20 5 1/2500 20 1/500 1/500 1/250 5 1 (1) (2) (3) OK One Point () and or
オンラインによる 「電子申告・納税等開始(変更等)届出書」 提出方法
18 2 1 OS 2 OS WWW OS Windows 2000 Professional Windows XP (Home Edition) Windows XP (Professional Edition) WWW Microsoft Internet Explorer 6.0 Windows 98 Windows Me WindowsNT OS e-tax 3 Internet Explorer
16 3 1....1 2....3 3....5 4....6 1....7 2....8 3....11 4....13 1....15 2....17 PRTR...20...23...30...35 1. 1 2 2. / / 29 / / 29 29 3 PRTR () () 29 29 * 29 4 3. 4 1 6 30 (1) 35 13 (2) 14 (3) PRTR 23 ID
- 2 Copyright (C) 2006. All Rights Reserved.
- 2 Copyright (C) 2006. All Rights Reserved. 2-3 Copyright (C) 2006. All Rights Reserved. 70-4 Copyright (C) 2006. All Rights Reserved. ...1...3...7...8 1...9...14...16 2...18...20...21 3...22...23...23...24
Adobe Acrobat DC 製品比較表
X X Adobe, the Adobe logo, Acrobat, the Adobe PDF logo, Creative Cloud, and Reader are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries.
KASPERSKY ENDPOINT SECURITY FOR BUSINESS IT IT IT IT IT Kaspersky Endpoint Security for Business IT IT IT IT 2013 NAC Advanced 2013 Select Select Work
KASPERSKY ENDPOINT SECURITY FOR BUSINESS IT IT IT IT IT Kaspersky Endpoint Security for Business IT IT IT IT 2013 NAC Advanced 2013 Select Select Workstation Core / + Web Kaspersky Security Center Kaspersky
PX-1004
NPD4541-0 ...5... 5... 8 Mac OS X...9 Mac OS X v10.5.x v10.6.x... 9 Mac OS X v10.4.11...12...14...15...16...20...21...23!ex...23 /...24 P.I.F. PRINT Image Framer...24...25...28...28...29...29...30...33
LAPLINK ヘルプデスク 導入ガイド
110-8654 1-3-5 LAPLINK TEL URL 03-3839-6039 http://www.intercom.co.jp/support/laplink_helpdesk/ 9: 00 12:00 13:00 17:00 LAPLINK URL TEL URL 03-3839-6307 http://www.intercom.co.jp/laplink_helpdesk/contact.html
Mac OS X Windows...15 Mac OS X...16 Windows /...24 /...24 / Windows...2
E-850 NPD5067-00 ...5... 5... 9 Mac OS X...9... 9...12...13...13...14...14...14 Windows...15 Mac OS X...16 Windows...17...17...20 /...24 /...24 /...26...28 Windows...28 Mac OS X...31 Windows...34...35...35...37
- 2 Copyright (C) 2009. All Rights Reserved.
- 2 Copyright (C) 2009. All Rights Reserved. - 3 Copyright (C) 2009. All Rights Reserved. - 4 Copyright (C) 2009. All Rights Reserved. - 5 Copyright (C) 2009. All Rights Reserved. - 6 Copyright (C) 2009.
FileMaker Pro Tutorial
FileMaker Pro 11 2007-2010 FileMaker, Inc. All Rights Reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMaker FileMaker, Inc. FileMaker, Inc. FileMaker FileMaker, Inc.
2
2 3 4 5 6 1 2 7 Windows Me Microsoft Office XP Personal Easy CD Creator4 8 9 DIGITAL 10 11 12 1 3 2 13 1 2 14 3 15 1 2 3 16 4 17 1 2 18 3 1 4 5 1 2 3 4 19 1 2 3 20 4 5 21 1 2 1 22 2 3 1 23 1 2 3 4 24 1
82801pdf.pqxp
PC Contents Chapter 1 PC / Chapter 2/ 1 2 SMS WAN BITS Chapter 3 SMS 2003 SMS SMS SMS 2003 2 6 8 9 9 10 11 12 13 14 16 17 17 18 19 19 20 20 21 22 24 24 25 25 26 26 27 28 PC PC PC PC PC IT 1 1 PC PC PC
PDF PDF Windows Vista Windows Vista Windows Windows XP Windows XP Windows Microsoft Office Excel 2007 Excel 2007 Excel Microsoft Office Excel 2003 Excel 2003 Excel Windows Internet Explorer 7 Internet
FileMaker Server Getting Started Guide
FileMaker Server 11 2004-2010 FileMaker, Inc. All Rights Reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMaker FileMaker, Inc. FileMaker, Inc. FileMaker FileMaker,
Flash Player ローカル設定マネージャー
ADOBE FLASH PLAYER http://help.adobe.com/ja_jp/legalnotices/index.html iii................................................................................................................. 1...........................................................................................................
PX-504A
NPD4537-00 ...6... 6... 9 Mac OS X...10 Mac OS X v10.5.x v10.6.x...10 Mac OS X v10.4.11...13...15...16...16...18...19...20!ex...20 /...21 P.I.F. PRINT Image Framer...21...22...26...26...27...27...27...31
how-to-decide-a-title
Contents 3 4 5 6 8 13 13 14 14 15 15 18 19 Copyright 2014 All Rights Reserved. 2 / 21 URL AdobeReader ( ) http://www.adobe.co.jp/products/acrobat/readstep2.html Copyright 2014 All Rights Reserved. 3 /
Adobe AIR のセキュリティ
ADOBE AIR http://help.adobe.com/ja_jp/legalnotices/index.html iii................................................................. 1.....................................................................
FileMaker Server Getting Started Guide
FileMaker Server 12 2007 2012 FileMaker, Inc. All Rights Reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMaker Bento FileMaker, Inc. Bento FileMaker, Inc. FileMaker
Security Solution 2008.pptx
Security Solution 2008 Windows DOS (apack, lzexe, diet, pklite) Linux (gzexe, UPX) PE PE DOS Stub Space Section Header.idata PE Header & Optional Header Space.unpack (unpack code) Section Header.unpack
FileMaker Pro Advanced Development Guide
FileMaker Pro 11 Advanced 2007 2010 FileMaker, Inc. All Rights Reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMakerFileMaker, Inc. FileMaker, Inc. FileMaker FileMaker,
ES-D400/ES-D350
NPD4650-00 ...4 EPSON Scan... 4 Document Capture Pro Windows... 7 EPSON Scan...10 EPSON Scan...10...14 PDF...15 / EPSON Scan...17 EPSON Scan...17 EPSON Scan...18 EPSON Scan...18 Document Capture Pro Windows...19
Hitachi Solutions, Ltd. 2015. All rights reserved. 1
Hitachi Solutions, Ltd. 2015. All rights reserved. Hitachi Solutions, Ltd. 2015. All rights reserved. 1 Acrobat PDF PDF ( ) ( ) PDF PDF PDF Office Visio PDF PDF PDF Hitachi Solutions, Ltd. 2015. All rights
EPSON PX-503A ユーザーズガイド
NPD4296-00 ...6... 6...10 Mac OS X...11 Mac OS X v10.5.x v10.6.x...11 Mac OS X v10.4.x...15...18...19...19...21...22...23!ex...23 /...24 P.I.F. PRINT Image Framer...24...25...28...28...29...29...30...33
PscanServシリーズ クイックリファレンス
HG/PscanServ PDF OCR (Windows2000/XP/Server2003 ) Copyright(c) HyperGEAR, Inc. 2006 Ver1.0.0 2006/10/31 2006/10/31 Vev1.0.0 2 1. PscanServ...5...5 2....6...6...7...7 3. PscanServ...9...9...9... 11 4....12...12...13
Adobe Bridge Bridge Bridge Bridge P10 Bridge Finder 2
Adobe InDesign InDesign PDF Flash Web CD DVD Adobe Campus Day Adobe Campus Day Adobe Campus Day 1 Adobe Bridge Bridge Bridge Bridge P10 Bridge Finder 2 InDesign InDesign... Web............ 3 POINT InDesign
Installation and New Features Guide for FileMaker Pro and FileMaker Pro Advanced
FileMaker For FileMaker Pro 8.5 and FileMaker Pro 8.5 Advanced 2005-2006 FileMaker, Inc. All Rights Reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMaker FileMaker,
2
DX Simulator Copyright 2001-2002 Yamaha Corporation. All rights reserved. Version 1.2, 2002 YAMAHA CORPORATION 2 z x z x c 3 z Windows Macintosh Windows Macintosh x 4 z Windows Macintosh Windows Macintosh
ハピタス のコピー.pages
Copyright (C) All Rights Reserved. 10 12,500 () ( ) ()() 1 : 2 : 3 : 2 4 : 5 : Copyright (C) All Rights Reserved. Copyright (C) All Rights Reserved. Copyright (C) All Rights Reserved. Copyright (C) All
Copyright 2008 All Rights Reserved 2
Copyright 2008 All Rights Reserved 1 Copyright 2008 All Rights Reserved 2 Copyright 2008 All Rights Reserved 3 Copyright 2008 All Rights Reserved 4 Copyright 2008 All Rights Reserved 5 Copyright 2008 All
EPSON ES-D200 パソコンでのスキャンガイド
NPD4271-00 ...4...7 EPSON Scan... 7...11 PDF...12 / EPSON Scan...13 EPSON Scan...13 EPSON Scan...14 EPSON Scan...14 EPSON Scan...15 Epson Event Manager...16 Epson Event Manager...16 Epson Event Manager...16
PX-434A/PX-404A
NPD4534-00 ...6... 6...10 Mac OS X...11 Mac OS X v10.5.x v10.6.x...11 Mac OS X v10.4.11...15...18...19...19...21...22!ex...22 /...23 P.I.F. PRINT Image Framer...23...24...26...27...27...28...28...31 Web...31...31...35...35...35...37...37...37...39...39...40...43...48
FileMaker Instant Web Publishing Guide
FileMaker 8 Web 2004-2005 FileMaker, Inc. All Rights Reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMaker FileMaker, Inc. ScriptMaker FileMaker, Inc. FileMaker FileMaker,
山梨県ホームページ作成ガイドライン
17 7 ...1...4...4...4...4...5...5 W3C...5...6...6...6...7...8...8...10...10...10... 11...12...12...13...13...13...14...14...14...15...15...16...16...16...16...16...17...18 15 (2003 ) 69.7 81.1 43.6 19.6
PX-403A
NPD4403-00 ...6... 6...10 Mac OS X...11 Mac OS X v10.5.x v10.6.x...11 Mac OS X v10.4.x...15...18...19...19...21...22!ex...22 /...23 P.I.F. PRINT Image Framer...23...24...27...27...28...28...28...32 Web...32...32...35...35...35...37...37...37...39...39...40...43...46
FileMaker Server 9 Getting Started Guide
FileMaker Server 10 2007-2009 FileMaker, Inc. All rights reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMaker Bento Bento FileMaker, Inc. Mac Mac Apple Inc. FileMaker
FileMaker Pro 15 および FileMaker Pro 15 Advanced インストールおよび新機能ガイド
FileMaker FileMaker Pro 15 FileMaker Pro 15 Advanced 2007-2016 FileMaker, Inc. All Rights Reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMaker FileMaker Go FileMaker,
インテル® VTune™ パフォーマンス・アナライザー 9.1 Windows* 版
VTune 9.1 Windows* ................................. 3...................... 3.................................................. 3............................................ 4 :.........................4................................................
FileMaker Pro 9 Advanced Development Guide
FileMaker Pro 10 Advanced 2007-2009 FileMaker, Inc. All rights reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMaker Bento Bento FileMaker, Inc. Mac Mac Apple Inc.
#include <stdio.h> unsigned char x86[] = { 0x8b, 0x44, 0x24, 0x04, // mov eax,[esp+4] 0x03, 0x44, 0x24, 0x08, // add eax,[esp+8] 0xc3 // ret }; int ma
x86 JIT Web JavaScript x86 JIT JIT x86 JIT Windows OS DEP x86 ASLR DEP ASLR Return-Oriented Programming JIT-Spraying JavaScript JIT x86 x86 JIT How to execute arbitrary code on x86 JIT Compiler Yoshinori
EP-704A
NPD4533-01 ...6... 6...10 Mac OS X...11 Mac OS X v10.5.x v10.6.x...11 Mac OS X v10.4.11...15...18...19...19...22...23...24!ex...24 /...25 P.I.F. PRINT Image Framer...25...26...29...29...30...30...31...34
PI_7„”“ƒ_P080~081fid”q‘‚’Ð
6s 80 ICD10 ICD9CM 81 7s 80 T-Time Microsoft Reader Adobe Acrobat ebook Reader Voyager T-Time DRM Microsoft Reader Passport Clear Type Adobe Acrobat ebook Reader EBX Cool Type Voyager T-Time Mac 81 8s
1000 Copyright(C)2009 All Rights Reserved - 2 -
1000 Copyright(C)2009 All Rights Reserved - 1 - 1000 Copyright(C)2009 All Rights Reserved - 2 - 1000 Copyright(C)2009 All Rights Reserved - 3 - 1000 Copyright(C)2009 All Rights Reserved - 4 - 1000 Copyright(C)2009
名刺ファイリングOCR ユーザーズガイド
OCR OCR OCR OCR OCR 2004 9 MicrosoftWindowsWindows NT Microsoft Corporation Netscape Netscape Communications Corporation Yahoo! JAPANhttp://www.yahoo.co.jp/ Microsoft Corporation OCR i Multilingual OCR
PX-B750F
NPD4539-00 ...6... 6... 9 Mac OS X...10 Mac OS X v10.5.x v10.6.x...10 Mac OS X v10.4.11...13...16...16...17...18...20...22!ex...22...23...26...27...27...28...28...30 Web...30...30...34...34...34...35...36...36...38...40...40...44...46...51
FileMaker Pro 9 Tutorial
FileMaker Pro 10 2007-2009 FileMaker, Inc. All rights reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMaker Bento Bento FileMaker, Inc. Mac Mac Apple Inc. FileMaker
SonicWALL SSL-VPN 4000 導入ガイド
COMPREHENSIVE INTERNET SECURITY SonicWALL セキュリティ装置 SonicWALL SSL-VPN 4000 導入ガイド 1 2 3 4 5 6 7 8 9-1 2 - 3 1 4 - 5 2 1. 2. 3 6 3 1. 2. 3. 4. 5. - 7 4 4 8 1. 2. 3. 4. 1. 2. 3. 4. 5. - 9 6. 7. 1. 2. 3. 1.
29 jjencode JavaScript
Kochi University of Technology Aca Title jjencode で難読化された JavaScript の検知 Author(s) 中村, 弘亮 Citation Date of 2018-03 issue URL http://hdl.handle.net/10173/1975 Rights Text version author Kochi, JAPAN http://kutarr.lib.kochi-tech.ac.jp/dspa
untitled
1 All Rights Reserved,Copyright C (2000-2008) e-marketplace A HA e-ingbiz.com All Rights Reserved,Copyright C (2000-2008) 2 ( 3 All Rights Reserved,Copyright C (2000-2008) EXCEL BU EXCEL All Rights Reserved,Copyright
Copyright 2009, SofTek Systems, Inc. All rights reserved.
PGI Visual Fortran Release 9.0 SofTek Copyright 2009, SofTek Systems, Inc. All rights reserved. \\\ \\ \\\ \\ \\ SofTek Systems, Inc \ SofTek Systems, Inc SofTek Systems, Inc SofTek Systems, Inc SofTek
PX-K100
NPD4398-00 ...5... 5... 5... 6...8 /...9...11...16...20...24...24...27 Mac OS X...28 Mac OS X v10.5.x v10.6.x...28 Mac OS X v10.4.x...31...33...34...34...37...37...38...39...39...41...42...43...43 Web...44...44...47...47...47...48...48...49
FileMaker Instant Web Publishing Guide
FileMaker 11 Web 2004-2010 FileMaker, Inc. All Rights Reserved. FileMaker, Inc. 5201 Patrick Henry Drive Santa Clara, California 95054 FileMaker Bento FileMaker, Inc. Bento FileMaker, Inc. FileMaker FileMaker,
