Hello and welcome back.
In this video, we are going to analyze how far are using.
So let's start search for social media and fire.
As as if you create a new project for a new project, nunchuck next and navigate to the project directory
on a desktop.
OK, we will use this one.
And we give a name now, a symbol for.
He was doing the.
Then dumped right into the food to import it.
Kissinger has correctly identified SFP executable ecdysiast 32 bit cloak.
OK, it is important, the fun now, OK?
Galloway says, just give me devices and now we're going to start, he said.
So we did drag the file into the browser to start the analysis in access to whatever you want to analyze
for us.
And he has at least some analyses to make sure the compiler parameter I.D. check.
Scroll down and check on the screen, there will be probably 18 for the PDB.
No need for this canonise
and giving eye on the bottom right hand corner for any progress.
This will take a few minutes, so I'll you and come back when it's done.
Finally, after a few minutes, Nedra has completed the analysis, so let's take a look at the entry
point and function.
So if you want faster, we can go to a spot and look for the entry function.
So they're looking at this and you go straight to the entry point.
And then now you see here the entry point is called the Security and it kookie, which is commonly found
in Windows B programs followed by a jump.
So if we look at the entry function here, scroll down and down here you will see common winds.
And, you know, it seems like the environment variable function.
And shortly after that, you get the function and it's all set for one yevsey zero.
Then shortly after that, you have an exit exit.
So this could be the signature for the women.
And, you know, that is a good program from earlier analysis.
So he has got a specific signature.
We can open up a median and take a look and we need signature.
So let's open the browser and head over to the end for winnin signature type capacity we need.
And take a look at this section here, and this is serving nature so we can copy this.
Copy.
Do not copy the semicolon and then come back to you, John, again.
This one you can double click to enter the information, how you can edit the signature.
So let's do Dana now.
Frankly, it functions in nature, so we base in here and remove the API prefix here and then click,
OK.
Now on the news, we have to specify the string B.W. string pointer to reduce string and he update your
signature accordingly, as you can see.
So this is the ME.
So every GUI program, even those who have a ring, me and you can see.
So this is a main function of, well, windows will start executing.
And here's a lot of interesting functions did for Wishin.
So you can spend a lot of time in analyzing this and could see this creativity.
So we just function.
This is Madres creating additional interest and so on.
OK, so I'll leave the analysis to you.
So your objective for this session was to show you how to detect custom Baccus and how to find the correct
memory to then you also now know how to open up and identify the with me so that we have come to the
end of this session.
And I read this to you to do your own analysis here.
So thank you for watching.