[SANS ISC] Anti-Debugging Technique based on Memory Protection

I published the following diary on isc.sans.edu: “Anti-Debugging Technique based on Memory Protection“:

Many modern malware samples implement defensive techniques. First of all, we have to distinguish sandbox-evasion and anti-debugging techniques. Today, sandboxes are an easy and quick way to categorize samples based on their behavior. Malware developers have plenty of tests to perform to detect the environment running their code. There are plenty of them, some examples: testing the disk size, the desktop icons, the uptime, processes, network interfaces MAC addresses, hostnames, etc… [Read more]