<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Reversing &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/reversing/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Sat, 13 Apr 2024 15:36:45 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.0</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Reversing &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>PyInstaller Extractor Package</title>
		<link>https://blog.cerbero.io/pyinstaller-extractor-package/</link>
					<comments>https://blog.cerbero.io/pyinstaller-extractor-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 06 Dec 2023 09:19:11 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[bytecode]]></category>
		<category><![CDATA[PYC]]></category>
		<category><![CDATA[Python]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Unpacker]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2887</guid>

					<description><![CDATA[We have released the PyInstaller Extractor package for all licenses of Cerbero Suite. PyInstaller is a tool that packages Python applications into standalone executables, compatible with Windows, Linux, and macOS. It works by analyzing Python scripts to discover every import statement and include the appropriate Python files, binaries, and libraries in the executable. Additionally, PyInstaller &#8230; <a href="https://blog.cerbero.io/pyinstaller-extractor-package/" class="more-link">Continue reading<span class="screen-reader-text"> "PyInstaller Extractor Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/pyinstaller-extractor-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2887</post-id>	</item>
		<item>
		<title>Reversing Complex PowerShell Malware</title>
		<link>https://blog.cerbero.io/reversing-complex-powershell-malware/</link>
					<comments>https://blog.cerbero.io/reversing-complex-powershell-malware/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 28 Mar 2023 10:21:28 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[beautifier]]></category>
		<category><![CDATA[Injection]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Reversing]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2617</guid>

					<description><![CDATA[In this post we&#8217;re going to analyze a multi-stage PowerShell malware, which gives us an opportunity to use our commercial PowerShell Beautifier package and its capability to replace variables. Sample SHA2-256: 2840D561ED4F949D7D1DADD626E594B9430DEEB399DB5FF53FC0BB1AD30552AA Interestingly, the malicious script is detected by only 6 out of 58 engines on VirusTotal. We open the script in Cerbero Suite, decode &#8230; <a href="https://blog.cerbero.io/reversing-complex-powershell-malware/" class="more-link">Continue reading<span class="screen-reader-text"> "Reversing Complex PowerShell Malware"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/reversing-complex-powershell-malware/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2617</post-id>	</item>
		<item>
		<title>API Solver Package</title>
		<link>https://blog.cerbero.io/api-solver-package/</link>
					<comments>https://blog.cerbero.io/api-solver-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 21 Feb 2022 11:12:36 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Shellcode]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2343</guid>

					<description><![CDATA[We have just released our API Solver package on Cerbero Store for all commercial licenses of Cerbero Suite Advanced. You can click on the image for a video introduction. API Solver comes very handy to analyze shellcode and it can also be used programmatically: from Pkg.APISolver import APISolver solver = APISolver(&#34;win32&#34;, (&#34;kernel32&#34;, &#34;urlmon&#34;)) for hash &#8230; <a href="https://blog.cerbero.io/api-solver-package/" class="more-link">Continue reading<span class="screen-reader-text"> "API Solver Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/api-solver-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2343</post-id>	</item>
		<item>
		<title>A Fun CTF-Like Malware</title>
		<link>https://blog.cerbero.io/a-fun-ctf-like-malware/</link>
					<comments>https://blog.cerbero.io/a-fun-ctf-like-malware/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 30 Sep 2021 13:07:14 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[Encrypted]]></category>
		<category><![CDATA[lnk]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[MSCrypto]]></category>
		<category><![CDATA[OLE]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Steganography]]></category>
		<category><![CDATA[VBA]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2224</guid>

					<description><![CDATA[From a Twitter post by InQuest, we analyzed an interesting malware: Encrypted MS Office Document, VBA, Windows Link File (LNK), OLE objects, Windows Help Files (CHM), PNG steganography and Powershell. SHA256: 46AFA83E0B43FDB9062DD3E5FB7805997C432DD96F09DDF81F2162781DAAF834 The analysis should take about 15-20 minutes in Cerbero Suite. Highly recommended! SPOILER ALERT: The images below show all the steps of our &#8230; <a href="https://blog.cerbero.io/a-fun-ctf-like-malware/" class="more-link">Continue reading<span class="screen-reader-text"> "A Fun CTF-Like Malware"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/a-fun-ctf-like-malware/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2224</post-id>	</item>
		<item>
		<title>Malicious Windows Link with Embedded Microsoft Cabinet</title>
		<link>https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/</link>
					<comments>https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 10 Sep 2020 04:28:53 +0000</pubDate>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[cab]]></category>
		<category><![CDATA[Cabinet]]></category>
		<category><![CDATA[Link]]></category>
		<category><![CDATA[lnk]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Reversing]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1893</guid>

					<description><![CDATA[You can find the original analysis for this malware at malwarebytes. As a bonus, in the video we show how to improve the static analysis of the final payload by resolving API calls. This script converts the decrypted blob hashes into a call index → api name dictionary. blob = bytes([ 0x6B, 0x65, 0x72, 0x6E, &#8230; <a href="https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/" class="more-link">Continue reading<span class="screen-reader-text"> "Malicious Windows Link with Embedded Microsoft Cabinet"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1893</post-id>	</item>
		<item>
		<title>Yet another PDF/XDP Malware</title>
		<link>https://blog.cerbero.io/yet-another-pdfxdp-malware/</link>
					<comments>https://blog.cerbero.io/yet-another-pdfxdp-malware/#comments</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Sun, 24 Jul 2016 22:36:17 +0000</pubDate>
				<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[PDF]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[XDP]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1640</guid>

					<description><![CDATA[Today we&#8217;re going to analyze yet another sample of PDF containing an XDP form. The difference between this sample and the one of my previous post is that this one will be less about JavaScript deobfuscation and more about anti-analysis tricks. If you want to follow hands-on the analysis, this is the link to the &#8230; <a href="https://blog.cerbero.io/yet-another-pdfxdp-malware/" class="more-link">Continue reading<span class="screen-reader-text"> "Yet another PDF/XDP Malware"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/yet-another-pdfxdp-malware/feed/</wfw:commentRss>
			<slash:comments>3</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1640</post-id>	</item>
		<item>
		<title>PDF/XDP Malware Reversing</title>
		<link>https://blog.cerbero.io/pdfxdp-malware-reversing/</link>
					<comments>https://blog.cerbero.io/pdfxdp-malware-reversing/#comments</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 05 May 2016 11:07:44 +0000</pubDate>
				<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[PDF]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[XDP]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1612</guid>

					<description><![CDATA[Recently version 2.6 of Profiler has been released and among the improvements support for XDP has been introduced. For those of you who are unfamiliar with XPD, here&#8217;s the Wikipedia description: &#8220;XML Data Package (XDP) is an XML file format created by Adobe Systems in 2003. It is intended to be an XML-based companion to &#8230; <a href="https://blog.cerbero.io/pdfxdp-malware-reversing/" class="more-link">Continue reading<span class="screen-reader-text"> "PDF/XDP Malware Reversing"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/pdfxdp-malware-reversing/feed/</wfw:commentRss>
			<slash:comments>1</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1612</post-id>	</item>
	</channel>
</rss>
