Malware Triage Tips: How To Stop Wasting Time in IDA On Packed Samples [ Twitch Clip ] 

Cannot overemphasize the importance here. So many malware authors are not geniuses at all, they're throwing very simple malware into packing and obfuscation frameworks. So let's throw their stuff into tools as well. Always go from high-level to low because a malware author's bread and butter is wasting your time.

very cool explanation. Nice talk about the API hammering. I also love the doggo[.]exe :)

The nose scratch counter made me buckle 🤣🤣

Great video as always! You should do a video on TLS callbacks and how you deal with malware utilizing them for anti-debugging/reversing, etc.

many years ago I had made a debugger that with the help of the files dbg and pdb first version v.2 of the system files, I extracted the function names and the relative addresses of the import/export table from the PE I could put the breakpoints on all the API I wanted and filter the contents of the value pushed on the stack and the return values, to quickly study the functioning of these APIs (I never loved Python, even if I know well how it works under the hood, I prefer to do things myself in assembly or C) then over time I modified it and made sure to lock it if the pushed values ​​were suspicious, (I also used it to see the function send and recv of the mswinsock, and with the help of a sniffer I discovered the servers where they connected )... at the time I remember that the only help we could have to do these things were the articles by Matt Pietrek, a hex editor and debugger for windows as w32dasm and SoftICE for the kernel ( that if used badly freeze the pc until reboot).... I wanted to add that as sandbox virtual machine for testing dll, exe or shellcode you can also use Unicorn with Libemu, they have been added hundreds of win32 API with about 15 dlls for Win; great tutorial this and others you have done for IDA Pro , I really enjoyed

You are a good teacher

Great video showing fundamental concepts :)

You can check entropy with radare.. i usually check entropy whenever I analyse binary files using R2.

Where does that "OOOF" sound effect come from? I needs it.

How does ida immediatly redirects you to main?. My ida has not signatures and it gets me to the entry point unless i have pdb

I tried to use cape, but it keep refusing to upload a sample, states Account inactive and I just created it. Any ideas?

where is the oalabs Catalog on process injection ? link me please

hi can you make video for how to setup keypatch/keystone plugn please bro ?

fireship voice ?

TwistedPanda