Re: [Full-disclosure] Malicious Code Analysis

2005-08-05 Thread Willem Koenings
On 8/5/05, mike king <[EMAIL PROTECTED]> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Thanks for all the feedback. I have always taken the poor mans > approach to this since its not really my job, but a fun hobby on > the side. for poor man's approach start with something easier l

Re: [Full-disclosure] Malicious Code Analysis

2005-08-05 Thread Willem Koenings
hi, > I'm now becoming very interested in learning more about malicious code > analysis in a virtual machine environment. I have read documentation > and set up the environment and tools etc.. However I have no malicious > code to look at! does anyone know of a way to get hold of some? > > Also,

RE: [Full-disclosure] Malicious Code Analysis

2005-08-05 Thread mike king
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Thanks for all the feedback. I have always taken the poor mans approach to this since its not really my job, but a fun hobby on the side. regards mike On Fri, 05 Aug 2005 02:49:49 -0700 Peter Kruse <[EMAIL PROTECTED]> wrote: >Hey, > >> These were not

RE: [Full-disclosure] Malicious Code Analysis

2005-08-05 Thread Peter Kruse
Hey, > These were not submitted to any AV vendors since Norton did flag them. > In the past I have submitted unknown trojans/ viruses like these to > Symantec when clients have been owned, but what can I say they are > hardly 0day more like 300 day. 8-) > http://www.bitsum.com/pec2.asp Yes,

RE: [Full-disclosure] Malicious Code Analysis

2005-08-05 Thread mike king
Of mike king >> Sent: 5. august 2005 02:40 >> To: full-disclosure@lists.grok.org.uk; [EMAIL PROTECTED] >> Subject: Re: [Full-disclosure] Malicious Code Analysis >> >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> Here you go; I got this mal

RE: [Full-disclosure] Malicious Code Analysis

2005-08-05 Thread Peter Kruse
[mailto:[EMAIL PROTECTED] On Behalf > Of mike king > Sent: 5. august 2005 02:40 > To: full-disclosure@lists.grok.org.uk; [EMAIL PROTECTED] > Subject: Re: [Full-disclosure] Malicious Code Analysis > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Here you go; I got th

Re: [Full-disclosure] Malicious Code Analysis

2005-08-05 Thread Ty Bodell
I found it helpful to use the SoTM's from the Honeynet project that focused on Malicious code RCE. Try 32 & 33. Best thing is you get to see how other people went about doing it to. http://www.honeynet.org/scans/scan32/ http://www.honeynet.org/scans/scan33/ Goodluck, Ty On 8/4/05, M4ch3T3 Hax

Re: [Full-disclosure] Malicious Code Analysis

2005-08-05 Thread Dunceor .
Or just go to http://vx.netlux.org On 8/5/05, M4ch3T3 Hax <[EMAIL PROTECTED]> wrote: > Hello all, > > I have recently graduated from a computers & networking course at > university and have spent alot of my time analysing network security > from a scanning/sniffing/hardening point of view. > > I

Re: [Full-disclosure] Malicious Code Analysis

2005-08-04 Thread mike king
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Here you go; I got this malware from a friend’s machine that had been infected. This was about 2 months ago so there about. Use a hex editer to give you what it was packed with and then just go from there. Good luck and have fun. download it from here

[Full-disclosure] Malicious Code Analysis

2005-08-04 Thread M4ch3T3 Hax
Hello all, I have recently graduated from a computers & networking course at university and have spent alot of my time analysing network security from a scanning/sniffing/hardening point of view. I'm now becoming very interested in learning more about malicious code analysis in a virtual machine