mandiant / mandiant/capa-rules
packed or obfuscated with invalid imports
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
Summary
IDA spits a warning on samples with destroyed or invalid imports. capa should identify this as well.
Examples
https://www.hex-rays.com/products/ida/support/tutorials/unpack_pe/manual/ links a binary. I can dig up more if needed.
Features
It's likely the the case that this requires work in the backend, maybe as a one-off feature.
Rule details
References
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the linked binary and the IDA warning, then read the referenced unpacking and reverse-engineering discussions. Identify the capa backend entry point for detecting destroyed or invalid imports and determine how a rule would represent it. Done means capa reliably identifies packed or obfuscated samples with invalid imports, with examples demonstrating the behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- reverse-engineering
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100