Trojan-Downloader.Win32.Small

[Teddy Rogers]

Trojan-Downloader.Win32.Small or Win32/PolyCrypt Analysis

PolyCrypt is spreaded through infected Websites by using Exploits or every other form of abusive Download mechanism. PolyCrypt is weakly Packer Protected, so with VMUnpack we can suddenly obtain the full working unpacked copy.

Trojan_DownloaderWin32Small.pdf

Ted.

[Unbekannt1]

That's all? It ends right before the analysis of msstub.dll...isn't there a second paper?

Thanks.

[evilcry]

That's all? It ends right before the analysis of msstub.dll...isn't there a second paper?

Uhm seems that the paper has lost a part of the original paper, the entire paper is here http://evilcodecave.wordpress.com/2008/05/...rypt-reversing/

Regards,

Evilcry

Edited May 24, 2008 by evilcry