vencedor

http://handlers.sans.org/jclausing/userdb.txt
http://reverse-engineering-scripts.googlecode.com/files/UserDB.TXT
http://research.pandasecurity.com/blogs/images/userdb.txt

https://raw.githubusercontent.com/guelfoweb/peframe/5beta/peframe/signatures/userdb.txt #

pypeid > https://github.com/libcrack/python-peid

pefile > https://github.com/erocarrera/pefile

 - 내장된 peutils는 3.x버전이다. 2.x버전을 사용하기위해서는 peutils만 아래 파일로 import

   - python 2.7 > https://github.com/hiddenillusion/AnalyzePE/blob/master/peutils.py

^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$

^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$

^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)|(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$

^[\\w!#$%&’*+/=?\`{|}~^-]+(?:\\.[!#$%&’*+/=?\`{|}~^-])+)*@(?:[A-Z0-9-]+\\.)+[A-z]{2,6}$

[a-zA-Z\d\s\-\,\#\.\+]+

  
^\d{5,6}(?:[-\s]\d{4})?$

^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})$

^\d{3}-\d{2}-\d{4}$

^(?:(?:\+?1\s*(?:[.-]\s*)?)?(?:\(\s*([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9])\s*\)|([2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9]))\s*(?:[.-]\s*)?)?([2-9]1[02-9]|[2-9][02-9]1|[2-9][02-9]{2})\s*(?:[.-]\s*)?([0-9]{4})(?:\s*(?:#|x\.?|ext\.?|extension)\s*(\d+))?$

^[\\w!#$%&’*+/=?\`{|}~^-]+(?:\\.[!#$%&’*+/=?\`{|}~^-])+)*@(?:[A-Z0-9-]+\\.)+[A-z]{2,6}$

packed.zip

악성코드 정보.1
 - 종류 : Packed.Backdoor.PE(1)
 - md5 : 259c82d6db2883dd135c87b0feb44069

   ☞ 악성코드의 C&C 접속
     - IP: 190.185.124.125, Port:443
     - IP: 202.137.244.198, Port:443   
     - IP: 220.132.191.110, Port:443

악성코드 정보.2
 - 종류 : Packed.Dropper.PE
 - md5 : 036bae8dd72bd70761960a90ea631ff1

   ☞ 악성코드 드랍경로
     - %USERPROFILE%\AppData\Local\\Microsoft\Office\15.0\msoia.exe /update

     - 종류 : Packed.Backdoor.PE(2)
     - md5 : 133a436ddb128520d5061e020f09cb16

   ☞ 드랍된 악성코드 복제경로

     - %USERPROFILE%\AppData\Local\Microsoft\Internet Explorer\IECompatData\ielowutil.exe /autostart

     - 종류 : Packed.Backdoor.PE(2)
     - md5 : 133a436ddb128520d5061e020f09cb16

   ☞ 드랍된 악성코드의 C&C 접속
     - IP: 190.185.124.125, Port:443
     - IP: 202.137.244.198, Port:443   
     - IP: 220.132.191.110, Port:443