A Quick Analysis of Malicious NSIS installers used to Disperse Malware
In Summary : This PE file (analyzed here with pecheck.py) contains a section named .ndata, that's an indicator that this executable wa...
https://updatesinfosec.blogspot.com/2018/05/a-quick-analysis-of-malicious-nsis.html
In Summary :
This PE file (analyzed here with pecheck.py) contains a section named .ndata, that's an indicator that this executable was created with the Nullsoft Scriptable Install System (NSIS). We're taking this sample as an opportunity to show some simple methods to analyze executables created with NSIS.
7-Zip is able to extract the content of NSIS installers: [...]
kindly refer the following link as follow up :
https://ift.tt/2se93SV
This PE file (analyzed here with pecheck.py) contains a section named .ndata, that's an indicator that this executable was created with the Nullsoft Scriptable Install System (NSIS). We're taking this sample as an opportunity to show some simple methods to analyze executables created with NSIS.
7-Zip is able to extract the content of NSIS installers: [...]
kindly refer the following link as follow up :
https://ift.tt/2se93SV
