4 ms·
The name of one of the protectors is 'Themida', not "Themeda". Aside from that, nice article. I wonder how many of the antiviruses complained when you actually
by nekitamo 12y ago
The name of one of the protectors is 'Themida', not "Themeda". Aside from that, nice article. I wonder how many of the antiviruses complained when you actually tried to execute your packed file? There should be a second round of heuristics then which would catch the malware after it's unpacked to disk.
- moyix 12y agoDo you mean unpacked in memory? Most packers don't write unpacked files to disk (it would make bypassing them a lot easier if they did...)