In this quick post we are going to extract juicy info from a raw memory image. This method can be helpful to find digital evidence from suspect computer. This post is not beginner friendly, so you need to have knowledge of some concept like Memory Imaging. …

In windows lnk is an extension of shortcut files. Windows create a shortcut which points to an actual file and run that application. In this post we will see how threat actor can abuse windows lnk feature and do some social engineering trick to make someone run a malicious application …

In this short write up, we will learn about pagefile and how pagefile forensic can help the investigator to get digital evidence from the operating system. What is a Pagefile? In Windows NT when RAM becomes full, the operating system uses your hard drive as virtual RAM and starts placing…

Recently I did a post on digital investigation of a backdoor PDF in that post I defined PDF structure and how to analyze these types of malicious files. In this post, we will see another method of investigating this malicious file. We will separate all the attachments and Stream Objects…

In this post we are going to investigate a malicious PDF file , as we all know a PDF file can be infected with embedded objects, JavaScript code, encoded stream to exploit the PDF reader and these days this type of attacks happening very often. We are getting these types…

Malware uses vaious techniques to hide it or evade from antivirus or EDR system. So I decided to discuss about a very intresting malware hiding technique Parent process spoofing. This technique is well discussed by many other infosec people and Didier Stevens blogged about this in 2009. …

Recently FireEye has released open-source malware analysis tool capa. It became very popular among malware analysts because of its ability to tell the capability of malware that’s what a portable executable file can do on executing on the windows machine. I decided to test it on some custom malware samples…

The Purpose of this article is to show how some websites are exposing their sensitive data and risking their user’s privacy. Recently some reports came out how some websites are exposing their kibana Instances due to misconfigure ElasticSearch Database so I decided to dig deeper to see how bad it…