Adam Kramer

Obsessed with cyber security and malware!! Hon. Prof. @OfficialUoM, SANS, Cyber Security Challenge, ex-Microsoft, ex-law enforcement.

[Adam Kramer @CyberKramer]

@chadtilbury @jsecurity101 https://t.co/1e8BaVSoaX

An experiment I did 8 years ago on same topic, may be helpful?

[Adam Kramer @CyberKramer]

@DarkReading @adamshostack https://t.co/ju015UoZHI

I did a similar experiment 8 years ago, see what you think of my technique

[Adam Kramer @CyberKramer]

@DanielGDresner So am I!

[Adam Kramer @CyberKramer]

@projects_for_u https://t.co/mhcUDYzqyW

[Adam Kramer @CyberKramer]

@cybercdh You seen this? https://t.co/mjUr5PPzEK

[Adam Kramer @CyberKramer]

@cybercdh And if there’s a plate of hobnobs, what’s the etiquette?

[Adam Kramer @CyberKramer]

@cybercdh @disclosedh1 ICQ, what is this 1995?

[Adam Kramer @CyberKramer]

@cybercdh Base-six(ty)

[Adam Kramer @CyberKramer]

@cybercdh https://t.co/dnL6IJCQlz 🤔

[Adam Kramer @CyberKramer]

@evo736 @sansforensics Awesome work

[Adam Kramer @CyberKramer]

@cybercdh In other news, ABBA are reforming... I’m not sure what’s more retro, these ‘exploits’ or dancing queen

[Adam Kramer @CyberKramer]

@cybercdh @MalwareJake Indeed, training video for any incident manager cyber or otherwise

[Adam Kramer @CyberKramer]

Experimenting with methods for “Inhibiting Malicious Macros by Blocking Risky API Calls” latest @sansforensics blog https://t.co/aztAGR4QYU

[Adam Kramer @CyberKramer]

@bowdej01 @cybercdh Big D spent his bonus funding this?

[Adam Kramer @CyberKramer]

@cybercdh @GossiTheDog Stop stealing my jokes!!!

[Adam Kramer @CyberKramer]

@cybercdh @snkhan ^ what he said

[Adam Kramer @CyberKramer]

@snkhan No trouble :) id get the newest one, most of the architecture at that level never changes, and if it’s brand new for Win10 the book will call that out- plus most orgs will be at win10 soon I’m sure

[Adam Kramer @CyberKramer]

@snkhan Yes :-) @cybercdh made a video on the subject too, as you said the TEST is an implied AND on the InternetOpen API return value, so the EFLAGS zero flag is set and JNZ jumps over the CALL which executes the rest of the code- https://t.co/l8WqdPLeCY (Ida is from 7 mins onwards)

[Adam Kramer @CyberKramer]

@snkhan Nice analysis!! :-)