book-cd : Malware Analyst's Cookbook

序

很早以前，屯了一本<<恶意软件分析诀窍与工具箱>>.
当时买书的时候是有光盘的, 现在不知道弄哪去了。
在网上找了一下，资源不好找。连作者的网站都没有提供下载.
最后，万能的google帮我找到了。
资源是iso, 要分成多个压缩包，为了以后能下载到所有压缩分卷，做个下载索引贴。
屯书也有一定好处，用到的时候伸手可得. 专业书读者太少，也就1版2版的就绝版了。
看纸质书的感觉比电子书好很多。感觉自己以后会用到，就想买下来，有点奢侈啊:)

资源

恶意软件分析诀窍与工具箱.zip
恶意软件分析诀窍与工具箱.z01
恶意软件分析诀窍与工具箱.z02
恶意软件分析诀窍与工具箱.z03

压缩分卷的HASH

恶意软件分析诀窍与工具箱.zip
Size: 3788131 bytes
SHA1: 6BBA6F09241B697A3517FFD6A423BCBCB070BEED

恶意软件分析诀窍与工具箱.z01
Size: 304087040 bytes
SHA1: FD5A83EC95519ED4C989DFC55E0CEF63390F55D8

恶意软件分析诀窍与工具箱.z02
Size: 304087040 bytes
SHA1: 3C4711108DAC48149F7529EA7F509BE859508215

恶意软件分析诀窍与工具箱.z03
Size: 304087040 bytes
SHA1: F8280B6626E0B37FAABF68620CF99AA85AE7B640

解压后的isoHASH

恶意软件分析诀窍与工具箱.iso
Size: 1021411328 bytes
SHA1: 0F0B7A0FC8EE96C974FCDE6915BDBB40DDA784FC

光盘文件列表

H:\1H:\10H:\11H:\12H:\13H:\14H:\15H:\16H:\17H:\2H:\3H:\4H:\5H:\6H:\8H:\9H:\CHECKSUMSH:\COPYINGH:\Malware figuresH:\license.txtH:\readme.txtH:\1\2H:\1\3H:\1\4H:\1\2\tgrab.shH:\1\3\torwget.pyH:\1\4\header_check.phpH:\10\10H:\10\2H:\10\3H:\10\4H:\10\7H:\10\8H:\10\9H:\10\10\somethingelse.plH:\10\10\tinyxp_googlebuzz_ntuser.datH:\10\2\offreg.dllH:\10\2\tsk-xview.exeH:\10\3\offreg-example.cH:\10\4\closehandle-src.zipH:\10\4\closehandle.exeH:\10\7\HTMLInjectionDetector-src.zipH:\10\7\HTMLInjectionDetector2.exeH:\10\7\cache.txtH:\10\7\dom.txtH:\10\8\disallowrun.plH:\10\8\pendingdelete.plH:\10\8\routes.plH:\10\8\shellexecutehooks.plH:\10\9\dumpcerts.plH:\11\10H:\11\12H:\11\2H:\11\3H:\11\9H:\11\10\findhooks.pyH:\11\12\pymon.pyH:\11\12\simpleapi.pyH:\11\2\scloader-src.zipH:\11\2\scloader.exeH:\11\3\stack_gcc.cH:\11\3\stack_gcc.exeH:\11\3\stack_vc.cH:\11\3\stack_vc.exeH:\11\9\scd.pyH:\12\1H:\12\10H:\12\11H:\12\12H:\12\2H:\12\1\xortools.pyH:\12\10\trickimprec.pyH:\12\11\kraken.pyH:\12\12\sbstrings.pyH:\12\2\xorsigs.yarH:\13\4H:\13\7H:\13\8H:\13\4\13-4.movH:\13\4\rundll32ex-src.zipH:\13\4\rundll32ex.exeH:\13\7\install_svc.batH:\13\7\install_svc.pyH:\13\8\dll2exe.pyH:\14\10H:\14\11H:\14\8H:\14\10\windbg_to_ida.pyH:\14\11\WinDbgNotify.txtH:\14\8\DriverEntryFinder.zipH:\15\6H:\15\6\prolaco.vmem.zipH:\16\6H:\16\7H:\16\8H:\16\6\coreflood.vmem.zipH:\16\6\silentbanker.vmem.zipH:\16\7\laqma.vmem.zipH:\16\8\16-8.movH:\17\1H:\17\10H:\17\11H:\17\6H:\17\8H:\17\1\zeus.vmem.zipH:\17\10\17-10.movH:\17\11\sality.vmem.zipH:\17\6\be2.vmem.zipH:\17\8\tigger.vmem.zipH:\2\wwwhoney.tgzH:\3\10H:\3\11H:\3\2H:\3\3H:\3\4H:\3\5H:\3\6H:\3\7H:\3\8H:\3\10\ssdeep_procs.pyH:\3\11\3-11.movH:\3\2\clam_hellologic.ldbH:\3\2\clam_helloworld.ndbH:\3\2\clam_inject.ldbH:\3\2\clam_shellcode.ndbH:\3\3\clamav_to_yara.pyH:\3\4\packer.yaraH:\3\4\peid_to_yara.pyH:\3\4\sample_script.pyH:\3\5\capabilities.yaraH:\3\6\magic.yaraH:\3\7\av_multiscan.pyH:\3\8\pescanner.pyH:\3\8\test_output.txtH:\4\10H:\4\11H:\4\12H:\4\4H:\4\8H:\4\9H:\4\10\appinitdll.jbsH:\4\10\killexplorer.jbsH:\4\11\proxy.jbsH:\4\12\artifacts.dbH:\4\12\artifactscanner.pyH:\4\12\dbmgr.pyH:\4\4\avsubmit.pyH:\4\4\virus.dbH:\4\8\bare.jbsH:\4\9\pathtrick.jbsH:\5\13H:\5\13\mapper.pyH:\6\1H:\6\10H:\6\11H:\6\14H:\6\9H:\6\1\6-1.movH:\6\10\graph.dotH:\6\10\graph.pngH:\6\10\shellcode_libemu.pyH:\6\11\6-11.movH:\6\14\pdf.pcapH:\6\9\6-9.movH:\6\9\sc_distorm.pyH:\6\9\shellcodeH:\6\9\shellcode\first_stage_disasm.txtH:\6\9\shellcode\second_stage_disasm.txtH:\6\9\shellcode\shellcode.binH:\6\9\shellcode\unicode_encoded_shellcodeH:\8\1H:\8\7H:\8\analysis.pyH:\8\vmauto.pyH:\8\1\8-1.movH:\8\1\myvbox.pyH:\8\7\1your_exe2.report.txtH:\8\7\8-7.movH:\8\7\myvmware.pyH:\9\10 to 14H:\9\15H:\9\3H:\9\5H:\9\6H:\9\7H:\9\8H:\9\10 to 14\Example_Log.txtH:\9\10 to 14\README.TXTH:\9\10 to 14\preservation.zipH:\9\10 to 14\preservationDriver-src.zipH:\9\10 to 14\preservationWin32-src.zipH:\9\15\InstallCmdProxy.exeH:\9\15\InstallCmdProxy.zipH:\9\15\cmd-src.zipH:\9\15\cmd.exeH:\9\3\9-3.movH:\9\3\RegFsNotify-src.zipH:\9\3\RegFsNotify.exeH:\9\3\RegFsNotify_example_log.txtH:\9\5\9-5.movH:\9\5\HandleDiff-src.zipH:\9\5\HandleDiff.exeH:\9\6\diff_zeus1x.txtH:\9\6\diff_zeus2x.txtH:\9\7\bankpatch_diff.txtH:\9\7\conlf.ini.htmlH:\9\8\DetoursHooks.zipH:\Malware figures\C01H:\Malware figures\C02H:\Malware figures\C03H:\Malware figures\C04H:\Malware figures\C05H:\Malware figures\C06H:\Malware figures\C07H:\Malware figures\C08H:\Malware figures\C09H:\Malware figures\C10H:\Malware figures\C11H:\Malware figures\C12H:\Malware figures\C13H:\Malware figures\C14H:\Malware figures\C15H:\Malware figures\C16H:\Malware figures\C17H:\Malware figures\C18H:\Malware figures\C01\613030 f0102.pngH:\Malware figures\C01\613030 f0103.pngH:\Malware figures\C01\613030 f0104.pngH:\Malware figures\C01\613030 f0106.pngH:\Malware figures\C01\613030 f0107.pngH:\Malware figures\C01\613030 f0108.pngH:\Malware figures\C01\613030 f0109.pngH:\Malware figures\C02\613030 f0202_e.pdfH:\Malware figures\C03\613030 f00301.pngH:\Malware figures\C03\613030 f00302.pngH:\Malware figures\C03\613030 f00303.callout.pngH:\Malware figures\C03\613030 f0303.pngH:\Malware figures\C03\613030 f0304.callout.pngH:\Malware figures\C03\613030 f0304.pngH:\Malware figures\C04\613030 f0401.pngH:\Malware figures\C04\613030 f0402.pngH:\Malware figures\C04\613030 f0403.pngH:\Malware figures\C04\613030 f0404.pngH:\Malware figures\C04\613030 f0405.pngH:\Malware figures\C04\613030 f0406.pngH:\Malware figures\C04\613030 f0407.pngH:\Malware figures\C04\613030 f0408.pngH:\Malware figures\C04\613030 f0409.pngH:\Malware figures\C04\613030 f0410.pngH:\Malware figures\C04\613030 f0411.pngH:\Malware figures\C04\613030 f0412.pngH:\Malware figures\C04\613030 f0413.pngH:\Malware figures\C05\613030 f0501.pngH:\Malware figures\C05\613030 f0502.pngH:\Malware figures\C05\613030 f0503.pngH:\Malware figures\C05\613030 f0504.pngH:\Malware figures\C05\613030 f0505.pngH:\Malware figures\C05\613030 f0506.pngH:\Malware figures\C05\613030 f0507.pngH:\Malware figures\C05\613030 f0508.pngH:\Malware figures\C05\613030 f0509.pngH:\Malware figures\C05\613030 f0510.pngH:\Malware figures\C05\613030 f0511.pngH:\Malware figures\C06\613030 f0601.pngH:\Malware figures\C06\613030 f0602.pngH:\Malware figures\C06\613030 f0603.pngH:\Malware figures\C06\613030 f0604.pngH:\Malware figures\C06\613030 f0605.pngH:\Malware figures\C06\613030 f0606.pngH:\Malware figures\C06\613030 f0607.pngH:\Malware figures\C07\613030 f0701.pngH:\Malware figures\C07\613030 f0702.pngH:\Malware figures\C07\613030 f0703.callout.pngH:\Malware figures\C07\613030 f0703.pngH:\Malware figures\C07\613030 f0704.callout.pngH:\Malware figures\C07\613030 f0704.pngH:\Malware figures\C07\613030 f0705.pngH:\Malware figures\C07\613030 f0706.callout.pngH:\Malware figures\C07\613030 f0706.pngH:\Malware figures\C07\613030 f0707a.PNGH:\Malware figures\C07\613030 f0707b.PNGH:\Malware figures\C07\613030 f0707callout.pngH:\Malware figures\C07\613030 f0708.PNGH:\Malware figures\C07\613030 f0709.pngH:\Malware figures\C07\613030 f0710.pngH:\Malware figures\C07\613030 f0711.pngH:\Malware figures\C07\613030 f0712.pngH:\Malware figures\C07\613030 f0713.pngH:\Malware figures\C07\613030 f0714.pngH:\Malware figures\C08\613030 f0801.pdfH:\Malware figures\C08\613030 f0802.pngH:\Malware figures\C08\613030 f0803.calloutsuggested.pngH:\Malware figures\C08\613030 f0803.pngH:\Malware figures\C08\613030 f0804.calloutsuggested.pngH:\Malware figures\C08\613030 f0804.pngH:\Malware figures\C08\613030 f0805.pngH:\Malware figures\C08\613030 f0806.calloutsuggested.pngH:\Malware figures\C08\613030 f0806.pngH:\Malware figures\C08\613030 f0807.calloutsuggested.pngH:\Malware figures\C08\613030 f0807.pngH:\Malware figures\C08\613030 f0808.pngH:\Malware figures\C08\613030 f0809.pngH:\Malware figures\C08\613030 f0810.calloutsuggested.pngH:\Malware figures\C08\613030 f0810.pngH:\Malware figures\C08\613030 f0811.pngH:\Malware figures\C08\613030 f0812.pngH:\Malware figures\C09\613030 f0901.callout.pngH:\Malware figures\C09\613030 f0901.pngH:\Malware figures\C09\613030 f0902.callout.pngH:\Malware figures\C09\613030 f0902.pngH:\Malware figures\C09\613030 f0903.pngH:\Malware figures\C09\613030 f0904.pngH:\Malware figures\C09\613030 f0905.pngH:\Malware figures\C09\613030 f0906.pngH:\Malware figures\C09\613030 f0907.pngH:\Malware figures\C09\613030 f0908.callout.pngH:\Malware figures\C09\613030 f0908.pngH:\Malware figures\C09\613030 f0909.pngH:\Malware figures\C09\613030 f0910.pngH:\Malware figures\C09\613030 f0911.pngH:\Malware figures\C09\613030 f0912.pngH:\Malware figures\C09\613030 f0914.pngH:\Malware figures\C09\613030 f0915.pngH:\Malware figures\C09\613030 f0916.pdfH:\Malware figures\C09\613030 f0917.pngH:\Malware figures\C09\613030 f0918.pngH:\Malware figures\C09\613030 f0919.callout.pngH:\Malware figures\C09\613030 f0919.pngH:\Malware figures\C09\613030 f0920.pngH:\Malware figures\C09\613030 f0921.pngH:\Malware figures\C09\613030 f0922.pngH:\Malware figures\C10\613030 f1001.pngH:\Malware figures\C10\613030 f1002.pngH:\Malware figures\C10\613030 f1003.pngH:\Malware figures\C10\613030 f1004.pngH:\Malware figures\C10\613030 f1005.pngH:\Malware figures\C10\613030 f1006.callout.pngH:\Malware figures\C10\613030 f1006.pngH:\Malware figures\C10\613030 f1007.callout.pngH:\Malware figures\C10\613030 f1007.pngH:\Malware figures\C10\613030 f1008.callout.pngH:\Malware figures\C10\613030 f1008.pngH:\Malware figures\C10\613030 f1009.callout.pngH:\Malware figures\C10\613030 f1009.pngH:\Malware figures\C10\613030 f1010.callout.pngH:\Malware figures\C10\613030 f1010.pngH:\Malware figures\C10\613030 f1011.callout.pngH:\Malware figures\C10\613030 f1011.pngH:\Malware figures\C10\613030 f1012.callout.pngH:\Malware figures\C10\613030 f1012.pngH:\Malware figures\C10\613030 f1013.callout.pngH:\Malware figures\C10\613030 f1013.pngH:\Malware figures\C10\613030 f1014.pngH:\Malware figures\C11\613030 f1101.pngH:\Malware figures\C11\613030 f1102.pngH:\Malware figures\C11\613030 f1103.pngH:\Malware figures\C11\613030 f1104.calloutsuggested.pngH:\Malware figures\C11\613030 f1104.pngH:\Malware figures\C11\613030 f1105.calloutsuggested.pngH:\Malware figures\C11\613030 f1105.pngH:\Malware figures\C11\613030 f1106.pngH:\Malware figures\C11\613030 f1107.pngH:\Malware figures\C11\613030 f1108.pngH:\Malware figures\C11\613030 f1109.pngH:\Malware figures\C11\613030 f1110.pngH:\Malware figures\C11\613030 f1111.pngH:\Malware figures\C11\613030 f1112.pngH:\Malware figures\C11\613030 f1113.pngH:\Malware figures\C11\613030 f1114.pngH:\Malware figures\C11\613030 f1115.pngH:\Malware figures\C11\613030 f1116.pdfH:\Malware figures\C11\613030 f1117.pngH:\Malware figures\C11\613030 f1118.pngH:\Malware figures\C11\613030 f1119.pngH:\Malware figures\C11\613030 f1120.pngH:\Malware figures\C11\613030 f1121.calloutsuggested.pngH:\Malware figures\C11\613030 f1121.pngH:\Malware figures\C11\613030 f1122.pngH:\Malware figures\C11\613030 f1123.pngH:\Malware figures\C11\613030 f1124.pngH:\Malware figures\C11\613030 f1125.pngH:\Malware figures\C11\613030 f1126.pngH:\Malware figures\C11\613030 f1127.pngH:\Malware figures\C12\613030 f1201.pngH:\Malware figures\C12\613030 f1202.pngH:\Malware figures\C12\613030 f1203.pngH:\Malware figures\C12\613030 f1204.callout.pngH:\Malware figures\C12\613030 f1204.pngH:\Malware figures\C12\613030 f1205.callout.pngH:\Malware figures\C12\613030 f1205.pngH:\Malware figures\C12\613030 f1206.pngH:\Malware figures\C12\613030 f1207.pngH:\Malware figures\C12\613030 f1208.pngH:\Malware figures\C12\613030 f1209.callout.pngH:\Malware figures\C12\613030 f1209.pngH:\Malware figures\C12\613030 f1210.callout.pngH:\Malware figures\C12\613030 f1210.pngH:\Malware figures\C12\613030 f1211.callout.pngH:\Malware figures\C12\613030 f1211.pngH:\Malware figures\C12\613030 f1212.callout.pngH:\Malware figures\C12\613030 f1212.pngH:\Malware figures\C12\613030 f1213.pngH:\Malware figures\C12\613030 f1214.callout.pngH:\Malware figures\C12\613030 f1214.pngH:\Malware figures\C12\613030 f1215.callout.pngH:\Malware figures\C12\613030 f1215.pngH:\Malware figures\C12\613030 f1216.pngH:\Malware figures\C12\613030 f1217.pngH:\Malware figures\C12\613030 f1218.callout.pngH:\Malware figures\C12\613030 f1218.pngH:\Malware figures\C12\613030 f1219.callout.pngH:\Malware figures\C12\613030 f1219.pngH:\Malware figures\C12\613030 f1220.callout.pngH:\Malware figures\C12\613030 f1220.pngH:\Malware figures\C12\613030 f1221.callout.pngH:\Malware figures\C12\613030 f1221.pngH:\Malware figures\C12\613030 f1222.pngH:\Malware figures\C12\613030 f1223.pngH:\Malware figures\C12\613030 f1224.pngH:\Malware figures\C12\613030 f1225.callout.pngH:\Malware figures\C12\613030 f1225.pngH:\Malware figures\C12\613030 f1226.pngH:\Malware figures\C12\613030 f1227.pngH:\Malware figures\C12\613030 f1228.pngH:\Malware figures\C12\613030 f1229.pngH:\Malware figures\C12\613030 f1230.pngH:\Malware figures\C13\613030 f1301.pngH:\Malware figures\C13\613030 f1302.pngH:\Malware figures\C13\613030 f1303.pngH:\Malware figures\C13\613030 f1304.pngH:\Malware figures\C13\613030 f1305.pngH:\Malware figures\C13\613030 f1306.callout.pngH:\Malware figures\C13\613030 f1306.pngH:\Malware figures\C13\613030 f1307.pngH:\Malware figures\C13\613030 f1308.callout.pngH:\Malware figures\C13\613030 f1308.pngH:\Malware figures\C13\613030 f1309.callout.pngH:\Malware figures\C13\613030 f1309.pngH:\Malware figures\C13\613030 f1310.callout.pngH:\Malware figures\C13\613030 f1310.pngH:\Malware figures\C13\613030 f1311.pngH:\Malware figures\C13\613030 f1312.pngH:\Malware figures\C13\613030 f1313.pngH:\Malware figures\C13\613030 f1314.pngH:\Malware figures\C13\613030 f1315.callout.pngH:\Malware figures\C13\613030 f1315.pngH:\Malware figures\C14\613030 f1403.pngH:\Malware figures\C14\613030 f1404.callout.pngH:\Malware figures\C14\613030 f1404.pngH:\Malware figures\C14\613030 f1405.pngH:\Malware figures\C14\613030 f1406.callout.pngH:\Malware figures\C14\613030 f1406.pngH:\Malware figures\C14\613030 f1407.callout.pngH:\Malware figures\C14\613030 f1407.pngH:\Malware figures\C14\613030 f1408.pngH:\Malware figures\C14\613030 f1409.pngH:\Malware figures\C14\613030 f1410.pngH:\Malware figures\C14\613030 f1411.callout.pngH:\Malware figures\C14\613030 f1411.pngH:\Malware figures\C14\613030 f1412.pngH:\Malware figures\C14\613030 f1413.pngH:\Malware figures\C14\613030 f1414.pngH:\Malware figures\C14\613030 f1415.pngH:\Malware figures\C14\613030 f1416.callout.pngH:\Malware figures\C14\613030 f1416.pngH:\Malware figures\C14\613030 f1417.pngH:\Malware figures\C14\613030 f1418.callout.pngH:\Malware figures\C14\613030 f1418.pngH:\Malware figures\C14\613030 f1419.pngH:\Malware figures\C14\613030 f1420.pngH:\Malware figures\C15\613030 f1501.pngH:\Malware figures\C15\613030 f1503.pngH:\Malware figures\C15\613030 f1504.pngH:\Malware figures\C15\613030 f1505.pngH:\Malware figures\C16\613030 f1601.callout.pngH:\Malware figures\C16\613030 f1601.pngH:\Malware figures\C16\613030 f1602.pngH:\Malware figures\C16\613030 f1604.pngH:\Malware figures\C16\613030 f1605.pngH:\Malware figures\C16\613030 f1607.callout.pngH:\Malware figures\C16\613030 f1607.pngH:\Malware figures\C16\613030 f1608.callout.pngH:\Malware figures\C16\613030 f1608.pngH:\Malware figures\C16\613030 f1609.pngH:\Malware figures\C16\613030 f1610.pngH:\Malware figures\C16\613030 f1611.pngH:\Malware figures\C16\613030 f1612.pngH:\Malware figures\C17\613030 f1702.pngH:\Malware figures\C17\613030 f1703.callout.pngH:\Malware figures\C17\613030 f1703.pngH:\Malware figures\C17\613030 f1706.pngH:\Malware figures\C17\613030 f1707.pngH:\Malware figures\C17\613030 f1710.callout.pngH:\Malware figures\C17\613030 f1710.pngH:\Malware figures\C17\613030 f1711.callout.pngH:\Malware figures\C17\613030 f1711.pngH:\Malware figures\C17\613030 f1712.callout.pngH:\Malware figures\C17\613030 f1712.pngH:\Malware figures\C17\613030 f1713.pngH:\Malware figures\C17\613030 f1714.pngH:\Malware figures\C17\613030 f1715.callout.pngH:\Malware figures\C17\613030 f1715.pngH:\Malware figures\C17\613030 f1716.callout.pngH:\Malware figures\C17\613030 f1716.pngH:\Malware figures\C17\613030 f1718.callout.pngH:\Malware figures\C17\613030 f1718.pngH:\Malware figures\C17\613030 f1719.pngH:\Malware figures\C18\613030 f1804.png