Bulletin

Unpacking x64 PE+ binaries: introduction part 1

Aleksander Czarnowski describes some of the main differences between the PE and PE+ file formats from the perspective of the binary unpacking process.

Noteven close

Code virtualization is a popular technique for making malware difficult to reverse engineer and analyse. W32/Noteven uses the technique, but has such a buggy interpreter that it's a wonder the code works at all. Peter Ferrie has the details.

Where should security reside?

‘It seems logical that, in the future, security must move closer to the information.' Greg Day, Symantec.

Malicious PDFs served by exploit kits

Although the PDF language was not designed to allow arbitrary code execution, implementation and design flaws in popular reader applications make it possible for criminals to infect machines via PDF documents. Didier Stevens explains how this is…

Malware design strategies for circumventing detection and prevention controls – part two

Aditya Sood and Richard Enbody discuss some of the different techniques that are used by present-day malware to circumvent protection mechanisms.

Andromeda botnet

Neo Tan (Fortinet)

The Andromeda botnet recruits its bots thanks to four key elements - compromised websites, an exploit kit, a downloader and a mailing engine - linked by four sequential phases. Neo Tan takes a closer look.

EICAR 2012

Eddy Willems presents a roundup of this year's EICAR conference in Portugal.

Understanding the domains involved in malicious activity on Facebook

Recent years have been marked by an explosive growth of social networks, with Facebook becoming one of the most attractive channels for cybercriminal activity. Alin Damian analyses some of the malicious domains extracted from Facebook applications…

So, enter stage right

Some virus writers try to find obscure side effects of instructions in an attempt to confuse virus analysts. Sometimes they succeed, and sometimes we already know about the side effects. The latter is the case with the technique used in the…

Automatically detecting spam at the cloud level using text fingerprints

With content-based anti-spam technologies decreasing in efficiency, Marius Tibeica and Adrian Toma propose a fingerprinting algorithm that maps similar text inputs to similar signatures.