Overview Windows programs use APIs to use OS functions. Regular programs are built to use the import table when it is built. Also, if the program uses the APIs dynamically, it can use the “LoadLibrary” and “GetProcAddress” API. Malware also uses APIs. However, if the malware simply used the API, it…

Overview I am analyzing one of the “Emotet” specimens found in the fall of 2020. The reason is that “Emotet” is one of the most abused malware in Japan. I’m also studying changes in malware tactics. …

Overview As techniques used by “Emotet” packers in the spring of 2020, I blogged about using “Function-based encryption” and “Heaven’s Gate.” Articles describe each technique and how to analyze it, but malware uses them in a series of steps. And the other techniques are also used. In this article, I will…

Beyond the “Heaven’s gate” Overview This article is a continuation of part 1. In part 1, I succeeded in extracting the 64-bit code executed by Heaven’s Gate. Analyzing this code, I found that it was injecting the code into the memory of the “svchost.exe” process created by the original code and…

Static analysis of “Heaven’s Gate” Overview In the spring of 2020, I obtained and analyzed a sample of malware called “Emotet”. The malware is one of the most violent malware in Japan in 2020. The malware used several techniques that bothered analysts. In an article I wrote earlier, I introduced the…

Overview In the spring of 2020, I obtained and analyzed a sample of malware called “Emotet”. The malware is one of the most violent malware in Japan in 2020. The malware used several techniques that bothered analysts. Most of the recently malware seen hides the main payload with a program called…