book-cd : Malware Analyst's Cookbook

最新推荐文章于 2017-08-10 09:35:00 发布

LostSpeed

最新推荐文章于 2017-08-10 09:35:00 发布

阅读量1.1k

点赞数 2

本文分享了《恶意软件分析诀窍与工具箱》一书的配套资源下载链接及校验信息，包括多个实用工具、示例代码和虚拟机镜像等，为读者提供了丰富的学习材料。

序

很早以前，屯了一本<<恶意软件分析诀窍与工具箱>>.
当时买书的时候是有光盘的, 现在不知道弄哪去了。
在网上找了一下，资源不好找。连作者的网站都没有提供下载.
最后，万能的google帮我找到了。
资源是iso, 要分成多个压缩包，为了以后能下载到所有压缩分卷，做个下载索引贴。
屯书也有一定好处，用到的时候伸手可得. 专业书读者太少，也就1版2版的就绝版了。
看纸质书的感觉比电子书好很多。感觉自己以后会用到，就想买下来，有点奢侈啊:)

资源

恶意软件分析诀窍与工具箱.zip
恶意软件分析诀窍与工具箱.z01
恶意软件分析诀窍与工具箱.z02
恶意软件分析诀窍与工具箱.z03

压缩分卷的HASH

恶意软件分析诀窍与工具箱.zip
Size: 3788131 bytes
SHA1: 6BBA6F09241B697A3517FFD6A423BCBCB070BEED

恶意软件分析诀窍与工具箱.z01
Size: 304087040 bytes
SHA1: FD5A83EC95519ED4C989DFC55E0CEF63390F55D8

恶意软件分析诀窍与工具箱.z02
Size: 304087040 bytes
SHA1: 3C4711108DAC48149F7529EA7F509BE859508215

恶意软件分析诀窍与工具箱.z03
Size: 304087040 bytes
SHA1: F8280B6626E0B37FAABF68620CF99AA85AE7B640

解压后的isoHASH

恶意软件分析诀窍与工具箱.iso
Size: 1021411328 bytes
SHA1: 0F0B7A0FC8EE96C974FCDE6915BDBB40DDA784FC

光盘文件列表

H:\1
H:\10
H:\11
H:\12
H:\13
H:\14
H:\15
H:\16
H:\17
H:\2
H:\3
H:\4
H:\5
H:\6
H:\8
H:\9
H:\CHECKSUMS
H:\COPYING
H:\Malware figures
H:\license.txt
H:\readme.txt
H:\1\2
H:\1\3
H:\1\4
H:\1\2\tgrab.sh
H:\1\3\torwget.py
H:\1\4\header_check.php
H:\10\10
H:\10\2
H:\10\3
H:\10\4
H:\10\7
H:\10\8
H:\10\9
H:\10\10\somethingelse.pl
H:\10\10\tinyxp_googlebuzz_ntuser.dat
H:\10\2\offreg.dll
H:\10\2\tsk-xview.exe
H:\10\3\offreg-example.c
H:\10\4\closehandle-src.zip
H:\10\4\closehandle.exe
H:\10\7\HTMLInjectionDetector-src.zip
H:\10\7\HTMLInjectionDetector2.exe
H:\10\7\cache.txt
H:\10\7\dom.txt
H:\10\8\disallowrun.pl
H:\10\8\pendingdelete.pl
H:\10\8\routes.pl
H:\10\8\shellexecutehooks.pl
H:\10\9\dumpcerts.pl
H:\11\10
H:\11\12
H:\11\2
H:\11\3
H:\11\9
H:\11\10\findhooks.py
H:\11\12\pymon.py
H:\11\12\simpleapi.py
H:\11\2\scloader-src.zip
H:\11\2\scloader.exe
H:\11\3\stack_gcc.c
H:\11\3\stack_gcc.exe
H:\11\3\stack_vc.c
H:\11\3\stack_vc.exe
H:\11\9\scd.py
H:\12\1
H:\12\10
H:\12\11
H:\12\12
H:\12\2
H:\12\1\xortools.py
H:\12\10\trickimprec.py
H:\12\11\kraken.py
H:\12\12\sbstrings.py
H:\12\2\xorsigs.yar
H:\13\4
H:\13\7
H:\13\8
H:\13\4\13-4.mov
H:\13\4\rundll32ex-src.zip
H:\13\4\rundll32ex.exe
H:\13\7\install_svc.bat
H:\13\7\install_svc.py
H:\13\8\dll2exe.py
H:\14\10
H:\14\11
H:\14\8
H:\14\10\windbg_to_ida.py
H:\14\11\WinDbgNotify.txt
H:\14\8\DriverEntryFinder.zip
H:\15\6
H:\15\6\prolaco.vmem.zip
H:\16\6
H:\16\7
H:\16\8
H:\16\6\coreflood.vmem.zip
H:\16\6\silentbanker.vmem.zip
H:\16\7\laqma.vmem.zip
H:\16\8\16-8.mov
H:\17\1
H:\17\10
H:\17\11
H:\17\6
H:\17\8
H:\17\1\zeus.vmem.zip
H:\17\10\17-10.mov
H:\17\11\sality.vmem.zip
H:\17\6\be2.vmem.zip
H:\17\8\tigger.vmem.zip
H:\2\wwwhoney.tgz
H:\3\10
H:\3\11
H:\3\2
H:\3\3
H:\3\4
H:\3\5
H:\3\6
H:\3\7
H:\3\8
H:\3\10\ssdeep_procs.py
H:\3\11\3-11.mov
H:\3\2\clam_hellologic.ldb
H:\3\2\clam_helloworld.ndb
H:\3\2\clam_inject.ldb
H:\3\2\clam_shellcode.ndb
H:\3\3\clamav_to_yara.py
H:\3\4\packer.yara
H:\3\4\peid_to_yara.py
H:\3\4\sample_script.py
H:\3\5\capabilities.yara
H:\3\6\magic.yara
H:\3\7\av_multiscan.py
H:\3\8\pescanner.py
H:\3\8\test_output.txt
H:\4\10
H:\4\11
H:\4\12
H:\4\4
H:\4\8
H:\4\9
H:\4\10\appinitdll.jbs
H:\4\10\killexplorer.jbs
H:\4\11\proxy.jbs
H:\4\12\artifacts.db
H:\4\12\artifactscanner.py
H:\4\12\dbmgr.py
H:\4\4\avsubmit.py
H:\4\4\virus.db
H:\4\8\bare.jbs
H:\4\9\pathtrick.jbs
H:\5\13
H:\5\13\mapper.py
H:\6\1
H:\6\10
H:\6\11
H:\6\14
H:\6\9
H:\6\1\6-1.mov
H:\6\10\graph.dot
H:\6\10\graph.png
H:\6\10\shellcode_libemu.py
H:\6\11\6-11.mov
H:\6\14\pdf.pcap
H:\6\9\6-9.mov
H:\6\9\sc_distorm.py
H:\6\9\shellcode
H:\6\9\shellcode\first_stage_disasm.txt
H:\6\9\shellcode\second_stage_disasm.txt
H:\6\9\shellcode\shellcode.bin
H:\6\9\shellcode\unicode_encoded_shellcode
H:\8\1
H:\8\7
H:\8\analysis.py
H:\8\vmauto.py
H:\8\1\8-1.mov
H:\8\1\myvbox.py
H:\8\7\1your_exe2.report.txt
H:\8\7\8-7.mov
H:\8\7\myvmware.py
H:\9\10 to 14
H:\9\15
H:\9\3
H:\9\5
H:\9\6
H:\9\7
H:\9\8
H:\9\10 to 14\Example_Log.txt
H:\9\10 to 14\README.TXT
H:\9\10 to 14\preservation.zip
H:\9\10 to 14\preservationDriver-src.zip
H:\9\10 to 14\preservationWin32-src.zip
H:\9\15\InstallCmdProxy.exe
H:\9\15\InstallCmdProxy.zip
H:\9\15\cmd-src.zip
H:\9\15\cmd.exe
H:\9\3\9-3.mov
H:\9\3\RegFsNotify-src.zip
H:\9\3\RegFsNotify.exe
H:\9\3\RegFsNotify_example_log.txt
H:\9\5\9-5.mov
H:\9\5\HandleDiff-src.zip
H:\9\5\HandleDiff.exe
H:\9\6\diff_zeus1x.txt
H:\9\6\diff_zeus2x.txt
H:\9\7\bankpatch_diff.txt
H:\9\7\conlf.ini.html
H:\9\8\DetoursHooks.zip
H:\Malware figures\C01
H:\Malware figures\C02
H:\Malware figures\C03
H:\Malware figures\C04
H:\Malware figures\C05
H:\Malware figures\C06
H:\Malware figures\C07
H:\Malware figures\C08
H:\Malware figures\C09
H:\Malware figures\C10
H:\Malware figures\C11
H:\Malware figures\C12
H:\Malware figures\C13
H:\Malware figures\C14
H:\Malware figures\C15
H:\Malware figures\C16
H:\Malware figures\C17
H:\Malware figures\C18
H:\Malware figures\C01\613030 f0102.png
H:\Malware figures\C01\613030 f0103.png
H:\Malware figures\C01\613030 f0104.png
H:\Malware figures\C01\613030 f0106.png
H:\Malware figures\C01\613030 f0107.png
H:\Malware figures\C01\613030 f0108.png
H:\Malware figures\C01\613030 f0109.png
H:\Malware figures\C02\613030 f0202_e.pdf
H:\Malware figures\C03\613030 f00301.png
H:\Malware figures\C03\613030 f00302.png
H:\Malware figures\C03\613030 f00303.callout.png
H:\Malware figures\C03\613030 f0303.png
H:\Malware figures\C03\613030 f0304.callout.png
H:\Malware figures\C03\613030 f0304.png
H:\Malware figures\C04\613030 f0401.png
H:\Malware figures\C04\613030 f0402.png
H:\Malware figures\C04\613030 f0403.png
H:\Malware figures\C04\613030 f0404.png
H:\Malware figures\C04\613030 f0405.png
H:\Malware figures\C04\613030 f0406.png
H:\Malware figures\C04\613030 f0407.png
H:\Malware figures\C04\613030 f0408.png
H:\Malware figures\C04\613030 f0409.png
H:\Malware figures\C04\613030 f0410.png
H:\Malware figures\C04\613030 f0411.png
H:\Malware figures\C04\613030 f0412.png
H:\Malware figures\C04\613030 f0413.png
H:\Malware figures\C05\613030 f0501.png
H:\Malware figures\C05\613030 f0502.png
H:\Malware figures\C05\613030 f0503.png
H:\Malware figures\C05\613030 f0504.png
H:\Malware figures\C05\613030 f0505.png
H:\Malware figures\C05\613030 f0506.png
H:\Malware figures\C05\613030 f0507.png
H:\Malware figures\C05\613030 f0508.png
H:\Malware figures\C05\613030 f0509.png
H:\Malware figures\C05\613030 f0510.png
H:\Malware figures\C05\613030 f0511.png
H:\Malware figures\C06\613030 f0601.png
H:\Malware figures\C06\613030 f0602.png
H:\Malware figures\C06\613030 f0603.png
H:\Malware figures\C06\613030 f0604.png
H:\Malware figures\C06\613030 f0605.png
H:\Malware figures\C06\613030 f0606.png
H:\Malware figures\C06\613030 f0607.png
H:\Malware figures\C07\613030 f0701.png
H:\Malware figures\C07\613030 f0702.png
H:\Malware figures\C07\613030 f0703.callout.png
H:\Malware figures\C07\613030 f0703.png
H:\Malware figures\C07\613030 f0704.callout.png
H:\Malware figures\C07\613030 f0704.png
H:\Malware figures\C07\613030 f0705.png
H:\Malware figures\C07\613030 f0706.callout.png
H:\Malware figures\C07\613030 f0706.png
H:\Malware figures\C07\613030 f0707a.PNG
H:\Malware figures\C07\613030 f0707b.PNG
H:\Malware figures\C07\613030 f0707callout.png
H:\Malware figures\C07\613030 f0708.PNG
H:\Malware figures\C07\613030 f0709.png
H:\Malware figures\C07\613030 f0710.png
H:\Malware figures\C07\613030 f0711.png
H:\Malware figures\C07\613030 f0712.png
H:\Malware figures\C07\613030 f0713.png
H:\Malware figures\C07\613030 f0714.png
H:\Malware figures\C08\613030 f0801.pdf
H:\Malware figures\C08\613030 f0802.png
H:\Malware figures\C08\613030 f0803.calloutsuggested.png
H:\Malware figures\C08\613030 f0803.png
H:\Malware figures\C08\613030 f0804.calloutsuggested.png
H:\Malware figures\C08\613030 f0804.png
H:\Malware figures\C08\613030 f0805.png
H:\Malware figures\C08\613030 f0806.calloutsuggested.png
H:\Malware figures\C08\613030 f0806.png
H:\Malware figures\C08\613030 f0807.calloutsuggested.png
H:\Malware figures\C08\613030 f0807.png
H:\Malware figures\C08\613030 f0808.png
H:\Malware figures\C08\613030 f0809.png
H:\Malware figures\C08\613030 f0810.calloutsuggested.png
H:\Malware figures\C08\613030 f0810.png
H:\Malware figures\C08\613030 f0811.png
H:\Malware figures\C08\613030 f0812.png
H:\Malware figures\C09\613030 f0901.callout.png
H:\Malware figures\C09\613030 f0901.png
H:\Malware figures\C09\613030 f0902.callout.png
H:\Malware figures\C09\613030 f0902.png
H:\Malware figures\C09\613030 f0903.png
H:\Malware figures\C09\613030 f0904.png
H:\Malware figures\C09\613030 f0905.png
H:\Malware figures\C09\613030 f0906.png
H:\Malware figures\C09\613030 f0907.png
H:\Malware figures\C09\613030 f0908.callout.png
H:\Malware figures\C09\613030 f0908.png
H:\Malware figures\C09\613030 f0909.png
H:\Malware figures\C09\613030 f0910.png
H:\Malware figures\C09\613030 f0911.png
H:\Malware figures\C09\613030 f0912.png
H:\Malware figures\C09\613030 f0914.png
H:\Malware figures\C09\613030 f0915.png
H:\Malware figures\C09\613030 f0916.pdf
H:\Malware figures\C09\613030 f0917.png
H:\Malware figures\C09\613030 f0918.png
H:\Malware figures\C09\613030 f0919.callout.png
H:\Malware figures\C09\613030 f0919.png
H:\Malware figures\C09\613030 f0920.png
H:\Malware figures\C09\613030 f0921.png
H:\Malware figures\C09\613030 f0922.png
H:\Malware figures\C10\613030 f1001.png
H:\Malware figures\C10\613030 f1002.png
H:\Malware figures\C10\613030 f1003.png
H:\Malware figures\C10\613030 f1004.png
H:\Malware figures\C10\613030 f1005.png
H:\Malware figures\C10\613030 f1006.callout.png
H:\Malware figures\C10\613030 f1006.png
H:\Malware figures\C10\613030 f1007.callout.png
H:\Malware figures\C10\613030 f1007.png
H:\Malware figures\C10\613030 f1008.callout.png
H:\Malware figures\C10\613030 f1008.png
H:\Malware figures\C10\613030 f1009.callout.png
H:\Malware figures\C10\613030 f1009.png
H:\Malware figures\C10\613030 f1010.callout.png
H:\Malware figures\C10\613030 f1010.png
H:\Malware figures\C10\613030 f1011.callout.png
H:\Malware figures\C10\613030 f1011.png
H:\Malware figures\C10\613030 f1012.callout.png
H:\Malware figures\C10\613030 f1012.png
H:\Malware figures\C10\613030 f1013.callout.png
H:\Malware figures\C10\613030 f1013.png
H:\Malware figures\C10\613030 f1014.png
H:\Malware figures\C11\613030 f1101.png
H:\Malware figures\C11\613030 f1102.png
H:\Malware figures\C11\613030 f1103.png
H:\Malware figures\C11\613030 f1104.calloutsuggested.png
H:\Malware figures\C11\613030 f1104.png
H:\Malware figures\C11\613030 f1105.calloutsuggested.png
H:\Malware figures\C11\613030 f1105.png
H:\Malware figures\C11\613030 f1106.png
H:\Malware figures\C11\613030 f1107.png
H:\Malware figures\C11\613030 f1108.png
H:\Malware figures\C11\613030 f1109.png
H:\Malware figures\C11\613030 f1110.png
H:\Malware figures\C11\613030 f1111.png
H:\Malware figures\C11\613030 f1112.png
H:\Malware figures\C11\613030 f1113.png
H:\Malware figures\C11\613030 f1114.png
H:\Malware figures\C11\613030 f1115.png
H:\Malware figures\C11\613030 f1116.pdf
H:\Malware figures\C11\613030 f1117.png
H:\Malware figures\C11\613030 f1118.png
H:\Malware figures\C11\613030 f1119.png
H:\Malware figures\C11\613030 f1120.png
H:\Malware figures\C11\613030 f1121.calloutsuggested.png
H:\Malware figures\C11\613030 f1121.png
H:\Malware figures\C11\613030 f1122.png
H:\Malware figures\C11\613030 f1123.png
H:\Malware figures\C11\613030 f1124.png
H:\Malware figures\C11\613030 f1125.png
H:\Malware figures\C11\613030 f1126.png
H:\Malware figures\C11\613030 f1127.png
H:\Malware figures\C12\613030 f1201.png
H:\Malware figures\C12\613030 f1202.png
H:\Malware figures\C12\613030 f1203.png
H:\Malware figures\C12\613030 f1204.callout.png
H:\Malware figures\C12\613030 f1204.png
H:\Malware figures\C12\613030 f1205.callout.png
H:\Malware figures\C12\613030 f1205.png
H:\Malware figures\C12\613030 f1206.png
H:\Malware figures\C12\613030 f1207.png
H:\Malware figures\C12\613030 f1208.png
H:\Malware figures\C12\613030 f1209.callout.png
H:\Malware figures\C12\613030 f1209.png
H:\Malware figures\C12\613030 f1210.callout.png
H:\Malware figures\C12\613030 f1210.png
H:\Malware figures\C12\613030 f1211.callout.png
H:\Malware figures\C12\613030 f1211.png
H:\Malware figures\C12\613030 f1212.callout.png
H:\Malware figures\C12\613030 f1212.png
H:\Malware figures\C12\613030 f1213.png
H:\Malware figures\C12\613030 f1214.callout.png
H:\Malware figures\C12\613030 f1214.png
H:\Malware figures\C12\613030 f1215.callout.png
H:\Malware figures\C12\613030 f1215.png
H:\Malware figures\C12\613030 f1216.png
H:\Malware figures\C12\613030 f1217.png
H:\Malware figures\C12\613030 f1218.callout.png
H:\Malware figures\C12\613030 f1218.png
H:\Malware figures\C12\613030 f1219.callout.png
H:\Malware figures\C12\613030 f1219.png
H:\Malware figures\C12\613030 f1220.callout.png
H:\Malware figures\C12\613030 f1220.png
H:\Malware figures\C12\613030 f1221.callout.png
H:\Malware figures\C12\613030 f1221.png
H:\Malware figures\C12\613030 f1222.png
H:\Malware figures\C12\613030 f1223.png
H:\Malware figures\C12\613030 f1224.png
H:\Malware figures\C12\613030 f1225.callout.png
H:\Malware figures\C12\613030 f1225.png
H:\Malware figures\C12\613030 f1226.png
H:\Malware figures\C12\613030 f1227.png
H:\Malware figures\C12\613030 f1228.png
H:\Malware figures\C12\613030 f1229.png
H:\Malware figures\C12\613030 f1230.png
H:\Malware figures\C13\613030 f1301.png
H:\Malware figures\C13\613030 f1302.png
H:\Malware figures\C13\613030 f1303.png
H:\Malware figures\C13\613030 f1304.png
H:\Malware figures\C13\613030 f1305.png
H:\Malware figures\C13\613030 f1306.callout.png
H:\Malware figures\C13\613030 f1306.png
H:\Malware figures\C13\613030 f1307.png
H:\Malware figures\C13\613030 f1308.callout.png
H:\Malware figures\C13\613030 f1308.png
H:\Malware figures\C13\613030 f1309.callout.png
H:\Malware figures\C13\613030 f1309.png
H:\Malware figures\C13\613030 f1310.callout.png
H:\Malware figures\C13\613030 f1310.png
H:\Malware figures\C13\613030 f1311.png
H:\Malware figures\C13\613030 f1312.png
H:\Malware figures\C13\613030 f1313.png
H:\Malware figures\C13\613030 f1314.png
H:\Malware figures\C13\613030 f1315.callout.png
H:\Malware figures\C13\613030 f1315.png
H:\Malware figures\C14\613030 f1403.png
H:\Malware figures\C14\613030 f1404.callout.png
H:\Malware figures\C14\613030 f1404.png
H:\Malware figures\C14\613030 f1405.png
H:\Malware figures\C14\613030 f1406.callout.png
H:\Malware figures\C14\613030 f1406.png
H:\Malware figures\C14\613030 f1407.callout.png
H:\Malware figures\C14\613030 f1407.png
H:\Malware figures\C14\613030 f1408.png
H:\Malware figures\C14\613030 f1409.png
H:\Malware figures\C14\613030 f1410.png
H:\Malware figures\C14\613030 f1411.callout.png
H:\Malware figures\C14\613030 f1411.png
H:\Malware figures\C14\613030 f1412.png
H:\Malware figures\C14\613030 f1413.png
H:\Malware figures\C14\613030 f1414.png
H:\Malware figures\C14\613030 f1415.png
H:\Malware figures\C14\613030 f1416.callout.png
H:\Malware figures\C14\613030 f1416.png
H:\Malware figures\C14\613030 f1417.png
H:\Malware figures\C14\613030 f1418.callout.png
H:\Malware figures\C14\613030 f1418.png
H:\Malware figures\C14\613030 f1419.png
H:\Malware figures\C14\613030 f1420.png
H:\Malware figures\C15\613030 f1501.png
H:\Malware figures\C15\613030 f1503.png
H:\Malware figures\C15\613030 f1504.png
H:\Malware figures\C15\613030 f1505.png
H:\Malware figures\C16\613030 f1601.callout.png
H:\Malware figures\C16\613030 f1601.png
H:\Malware figures\C16\613030 f1602.png
H:\Malware figures\C16\613030 f1604.png
H:\Malware figures\C16\613030 f1605.png
H:\Malware figures\C16\613030 f1607.callout.png
H:\Malware figures\C16\613030 f1607.png
H:\Malware figures\C16\613030 f1608.callout.png
H:\Malware figures\C16\613030 f1608.png
H:\Malware figures\C16\613030 f1609.png
H:\Malware figures\C16\613030 f1610.png
H:\Malware figures\C16\613030 f1611.png
H:\Malware figures\C16\613030 f1612.png
H:\Malware figures\C17\613030 f1702.png
H:\Malware figures\C17\613030 f1703.callout.png
H:\Malware figures\C17\613030 f1703.png
H:\Malware figures\C17\613030 f1706.png
H:\Malware figures\C17\613030 f1707.png
H:\Malware figures\C17\613030 f1710.callout.png
H:\Malware figures\C17\613030 f1710.png
H:\Malware figures\C17\613030 f1711.callout.png
H:\Malware figures\C17\613030 f1711.png
H:\Malware figures\C17\613030 f1712.callout.png
H:\Malware figures\C17\613030 f1712.png
H:\Malware figures\C17\613030 f1713.png
H:\Malware figures\C17\613030 f1714.png
H:\Malware figures\C17\613030 f1715.callout.png
H:\Malware figures\C17\613030 f1715.png
H:\Malware figures\C17\613030 f1716.callout.png
H:\Malware figures\C17\613030 f1716.png
H:\Malware figures\C17\613030 f1718.callout.png
H:\Malware figures\C17\613030 f1718.png
H:\Malware figures\C17\613030 f1719.png
H:\Malware figures\C18\613030 f1804.png