I wanted to wait on releasing this until I made some more queries, but that may take a few days, so here it is now. The night I got all my malicious files into my MongoDB instance I started to query. One of the first things I wanted to tackle was ...
Read more →Since releasing the malpdfobj tool (~24 hours), I have been running and testing it. I found a couple bugs that caused issues when inserting some samples into the database, but those are all now fixed (and documented on github). The current code de...
Read more →I finally got a chance to sit down and work on the format for a malicious sample that would then get inserted into MongoDB. I am not certain if this is exactly how the final format will be represented, but it does work for now in storing a lot of ...
Read more →Over the past few days I have been grabbing more and more characteristics from this malware and I have reached a problem. The data is quite dynamic on multiple levels which makes it hard to store in a standard database. What exactly do I mean? Wel...
Read more →