Nytro Posted September 7, 2010 Report Posted September 7, 2010 Backdoor.Win32.UltimateDefender.gtz - ReversingIn this paper (Backdoor.Win32.UltimateDefender.gtz - Reversing) we analyze install.exe that presents the typical structure of an Medium Evoluted Malware, with basical Obfuscated-Dummy Code, some layer of Encryption decoded at Runtime and Custom Hash Functions used as Integrity Check. We can also see an intersting technique that retrieves API's Addresses OnDemand through a series of hardcoded values that corresponds to some API, the correspondent API Address is computated at runtime and chosen in function of the Hardcoded Value.Download:http://rootkitanalytics.com/papers/pdf/Backdoor-UltimateDefender.pdf Quote
