I often encounter software, especially when performing malware analysis, that dynamically constructs it’s own import table. This can be...

On 11/10/2020, AnyRun posted an Emotet maldoc that utilized CertUtil to decode a DLL payload that was used for unpacking and running the...

Behavioral information is a key indicator used to determine if an office document is malicious or not. I’ve recently seen a series of...

Debugging a DLL is not quite as straight forward as an executable, since you have to use rundll32 to load it and invoke DllMain. This is...