neonprimetime security , just trying to help

Started with this redline malware sample  https://www.joesandbox.com/analysis/808971/0/html Which the sandbox says dumps a bunch of child-...

 call ds:__imp__FDICreate (creates context for extracting Microsoft .CAB Cabinet files) ... push offset pszCabPath  call ds:__imp__FDICopy Y...

 v0 = FindResourceA(0, "UPROMPT", (LPCSTR)0xA); or push 0xA ; lpType push edi ; lpName push 0 ; hModule call ds:__imp__Findresourc...

CreateProcessInternalW CreationFlags: CREATE_SUSPENDED 0x00000004 Malware creating a process in a suspended state typically from a packer an...

 VirtualProtectEx Protection: PAGE_EXECUTE_READWRITE 0x40 in malware that almost always means "injected code"

 IDA Pro error The graph is too big (more than 1000 nodes) two options as to why the graph is "too big" 1) either it's obfusca...

 Notes just for me learning CPPEH_RECORD = exception handling __guard_check_icall_fptr = control flow guard _initterm = creation function po...

 Ascii strings "highlight the string", press 'a' Unicode strings highlight the ascii string, press 'Alt-a', choose...

1.) Open malware in IDA 2.) Find the 'ret' of WinMain and look for closes "call" statements above it 3.) Find a VirtualAll...

 FlawedAmmyy unpacking https://guidedhacking.com/threads/how-to-unpack-flawedammyy-malware-unpacking-tutorial.16637/ 7fb83e646cbabc50bec4b33...

 https://resources.infosecinstitute.com/topic/ida-cross-references-xrefs/ XREF ,  "...After the arrow, there’s also a single letter......

so i'm going to try in IDA hit SHIFT-F2, select python, type in this code  filename = AskFile(1, "*.bin", "Output fil...

emotet mfc https://app.any.run/tasks/585ddd5e-0dde-421f-8b8a-e7dbaf4f8c05/ 3F32E053657036D09C84D6DAD220EF50 my random notes on where i g...

random scattered notes https://app.any.run/tasks/585ddd5e-0dde-421f-8b8a-e7dbaf4f8c05/ 3F32E053657036D09C84D6DAD220EF50 update: after-...

If you are trying to debug a DLL and getting a wermgr fault using IDA it may be because you are using the WRONG version of rundll32.exe th...