Reverse EngineeringMalware

pe-viewer—C:\Samples\mzheader reverse engineering / malware

.text:0000 ; Liam Chugg — Security Researcher @ CrowdStrike

.text:0004 ; I enjoy picking apart malware, everything here is reproducible if you want to follow along

.text:0008 ; Samples: VirusTotal · MalwareBazaar · github.com/MZHeader/samples

.text:000C ; → more about me ▼

.text:0010 ; ────────────────────────────────────────────────────────

.text:0014 ; Hey! I'm Liam, a Security Researcher at CrowdStrike.

.text:0018 ; I originally started this blog while working as a security

.text:001C ; analyst, mainly as a way to get into reverse engineering

.text:0020 ; and sharpen my skills. Over time it's grown into a place

.text:0024 ; where I share things I find interesting, from challenges

.text:0028 ; to random deep dives. Hoping to keep it growing with

.text:002C ; even more cool stuff!

.text:0030 ; ────────────────────────────────────────────────────────

Section[1] .rsrc VirtualAddress: 0x00004000 VirtualSize: 0x00001200 Characteristics: 0x40000040

; filter:

Section[2] .lnkin VirtualAddress: 0x00006000 VirtualSize: 0x00000200 Characteristics: 0x00000200

Section[3] .gthb VirtualAddress: 0x00007000 VirtualSize: 0x00000200 Characteristics: 0x00000200

Section[4] .xcom VirtualAddress: 0x00008000 VirtualSize: 0x00000200 Characteristics: 0x00000200

; hover a .rsrc entry
; to inspect resource data