{"id":122850,"date":"2022-04-25T17:55:56","date_gmt":"2022-04-26T00:55:56","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=122850"},"modified":"2022-04-25T18:04:03","modified_gmt":"2022-04-26T01:04:03","slug":"bazarloader-anti-analysis-techniques","status":"publish","type":"post","link":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/","title":{"rendered":"BazarLoader\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u308b"},"content":{"rendered":"

<\/a>\u6982\u8981<\/strong><\/h2>\n

\u30de\u30eb\u30a6\u30a7\u30a2\u4f5c\u6210\u8005\u306f\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u3044\u304f\u3064\u3082\u30b3\u30fc\u30c9\u306b\u57cb\u3081\u8fbc\u3093\u3067\u4eba\u9593\u306e\u30a2\u30ca\u30ea\u30b9\u30c8\u3084\u30b5\u30f3\u30c9\u30dc\u30c3\u30af\u30b9\u5206\u6790\u30d7\u30ed\u30bb\u30b9\u3092\u90aa\u9b54\u3057\u3066\u304d\u307e\u3059\u304c\u3001\u9632\u5fa1\u5074\u306b\u3082\u305d\u3046\u3057\u305f\u6280\u8853\u3092\u6253\u3061\u7834\u308b\u6280\u8853\u306f\u3042\u308a\u307e\u3059\u3002\u672c\u7a3f\u306f\u7279\u5fb4\u7684\u306a\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u30922\u70b9\u63a1\u7528\u3057\u3066\u3044\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u3088\u308a\u9ad8\u901f\u306b\u89e3\u6790\u3059\u308b\u305f\u3081\u306e\u6280\u8853\u30922\u3064\u3054\u7d39\u4ecb\u3057\u307e\u3059\u30021\u3064\u3081\u306e\u6280\u8853\u306f\u300cAPI\u95a2\u6570\u306e\u30cf\u30c3\u30b7\u30e5\u5316\u300d\u3068\u3044\u3046\u3088\u304f\u77e5\u3089\u308c\u305f\u6280\u3067\u3001\u3069\u306e\u95a2\u6570\u304c\u547c\u3073\u51fa\u3055\u308c\u305f\u304b\u3092\u96e3\u8aad\u5316\u3057\u307e\u3059\u30022\u3064\u3081\u306e\u6280\u8853\u306f\u300c\u4e0d\u900f\u660e\u8ff0\u8a9e (opaque predicate)\u300d\u3067\u3001\u3053\u308c\u306f\u5236\u5fa1\u30d5\u30ed\u30fc\u306e\u96e3\u8aad\u5316\u306b\u4f7f\u308f\u308c\u307e\u3059\u3002<\/p>\n

\u672c\u7a3f\u3067\u7d39\u4ecb\u3059\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001BazarLoader\u3084\u3001\u4f3c\u305f\u3088\u3046\u306a\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u4f7f\u3046\u3079\u3064\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u30d5\u30a1\u30df\u30ea\u306b\u3082\u4f7f\u3048\u307e\u3059\u3002\u3053\u3053\u3067\u306f\u53c2\u8003\u3068\u3057\u3066\u3001\u6700\u8fd1\u79c1\u305f\u3061\u304c\u30ea\u30d0\u30fc\u30b9\u30a8\u30f3\u30b8\u30cb\u30a2\u30ea\u30f3\u30b0\u30c4\u30fc\u30eb\u306eIDA Pro\u3067BazarLoader\u3092\u89e3\u6790\u3057\u305f\u3055\u3044\u306b\u4f5c\u6210\u3057\u305fIDAPython<\/a>\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u7d39\u4ecb\u3057\u3001\u3053\u306e\u624b\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u3063\u3066\u307f\u305f\u3044\u3068\u601d\u3044\u307e\u3059\u3002\u306a\u304a\u3001BazarLoader\u3068\u3044\u3046\u306e\u306f\u3001\u3055\u307e\u3056\u307e\u306a\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u30b0\u30eb\u30fc\u30d7<\/a>\u304c\u4f7f\u3063\u3066\u3044\u308bWindows\u30d0\u30c3\u30af\u30c9\u30a2\u3067\u3059\u3002<\/p>\n

\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001Cortex XDR <\/a>\u307e\u305f\u306fWildFire<\/a>\u3068\u8105\u5a01\u9632\u5fa1<\/a>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b5\u30d6\u30b9\u30af\u30ea\u30d7\u30b7\u30e7\u30f3\u3092\u6709\u52b9\u306b\u3057\u305f\u6b21\u4e16\u4ee3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u306b\u3088\u308a\u3001\u540c\u69d8\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u4f7f\u7528\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u30d5\u30a1\u30df\u30ea\u304b\u3089\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n\n
\u672c\u7a3f\u3067\u89e3\u8aac\u3059\u308b\u4e3b\u306a\u30de\u30eb\u30a6\u30a7\u30a2<\/span><\/td>\nBazarLoader<\/span><\/a><\/td>\n<\/tr>\n
Unit 42\u306e\u95a2\u9023\u30c8\u30d4\u30c3\u30af<\/span><\/td>\nMalware<\/span><\/a>, <\/span>anti-analysis techniques<\/span><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/a>\u76ee\u6b21<\/h2>\n

\u30de\u30eb\u30a6\u30a7\u30a2\u30b3\u30fc\u30c9\u3092\u518d\u5229\u7528\u3057\u3066API\u547c\u3073\u51fa\u3057\u306e\u96e3\u8aad\u5316\u3092\u7834\u308b<\/a>
\n\u300c\u4e0d\u900f\u660e\u8ff0\u8a9e\u300d\u306e\u9664\u53bb\u3092\u81ea\u52d5\u5316\u3059\u308b<\/a>
\n\u30de\u30eb\u30a6\u30a7\u30a2\u30a2\u30ca\u30ea\u30b9\u30c8\u5bfe\u30de\u30eb\u30a6\u30a7\u30a2\u4f5c\u6210\u8005<\/a>
\nIoC<\/a>
\n\u8ffd\u52a0\u30ea\u30bd\u30fc\u30b9<\/a><\/p>\n

\u30de\u30eb\u30a6\u30a7\u30a2\u30b3\u30fc\u30c9\u3092\u518d\u5229\u7528\u3057\u3066API\u547c\u3073\u51fa\u3057\u306e\u96e3\u8aad\u5316\u3092\u7834\u308b<\/strong><\/h2>\n

\u30cd\u30a4\u30c6\u30a3\u30d6\u30d5\u30a1\u30a4\u30eb\u3068\u3057\u3066\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u60aa\u610f\u306e\u3042\u308b\u632f\u308b\u821e\u3044\u3092\u5b9f\u884c\u3059\u308b\u306b\u306f\u3001Windows\u306eAPI\u95a2\u6570\u3092\u547c\u3073\u51fa\u3059\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u305d\u306e\u305f\u3081\u306b\u3069\u306eAPI\u95a2\u6570\u3092\u4f7f\u3046\u304b\u306b\u3064\u3044\u3066\u306e\u60c5\u5831\u306f\u3001\u901a\u5e38\u306f\u30cd\u30a4\u30c6\u30a3\u30d6\u30d5\u30a1\u30a4\u30eb\u5185\u306eIAT(\u30a4\u30f3\u30dd\u30fc\u30c8\u30a2\u30c9\u30ec\u30b9\u30c6\u30fc\u30d6\u30eb)\u306b\u683c\u7d0d\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3057\u305f\u304c\u3063\u3066\u3053\u306e\u30c6\u30fc\u30d6\u30eb\u306f\u300c\u305d\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u4f55\u3092\u3057\u3088\u3046\u3068\u3057\u3066\u3044\u308b\u306e\u304b\u300d\u3092\u77e5\u308b\u5206\u6790\u30d7\u30ed\u30bb\u30b9\u3092\u59cb\u3081\u308b\u306e\u306b\u3046\u3063\u3066\u3064\u3051\u306e\u5834\u6240\u3067\u3059\u3002<\/p>\n

\u3053\u306e\u30c7\u30e2\u3092\u3059\u308b\u306e\u306b\u3042\u305f\u308a\u3001\u79c1\u305f\u3061\u306f\u6700\u8fd1\u691c\u51fa\u3057\u305fBazarLoader\u306e\u30b5\u30f3\u30d7\u30eb\u306b\u76ee\u3092\u3064\u3051\u307e\u3057\u305f\u3002\u305d\u306eBazarLoader\u30b5\u30f3\u30d7\u30eb\u304b\u3089\u30d1\u30c3\u30ab\u30fc\u306e\u5c64\u3092\u5265\u304c\u3057\u3066\u307f\u308b\u3068\u3001IAT\u304c\u306a\u3044\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f(\u56f31\u53c2\u7167)\u3002\u307e\u305f\u307b\u304b\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3067\u6642\u304a\u308a\u898b\u3089\u308c\u308b\u624b\u6cd5\u3067\u3042\u308b\u300c\u5b9f\u884c\u4e2d\u306b\u69cb\u7bc9\u3055\u308c\u308bIAT\u300d\u3082\u5b58\u5728\u3057\u307e\u305b\u3093\u3067\u3057\u305f\u3002BazarLoader\u306f\u95a2\u6570\u547c\u3073\u51fa\u3057\u3092\u96e3\u8aad\u5316\u3057\u3066\u89e3\u6790\u3057\u3065\u3089\u304f\u3057\u3001\u307e\u305fIAT\u306e\u8aad\u307f\u53d6\u308a\u306b\u983c\u308b\u691c\u51fa\u6280\u8853\u3092\u56de\u907f\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

\"BazarLoader\u306f\u95a2\u6570\u547c\u3073\u51fa\u3057\u3092\u96e3\u8aad\u5316\u3057\u3066\u89e3\u6790\u3057\u3065\u3089\u304f\u3057\u3001\u307e\u305fIAT\u306e\u8aad\u307f\u53d6\u308a\u306b\u983c\u308b\u691c\u51fa\u6280\u8853\u3092\u56de\u907f\u3057\u3066\u3044\u307e\u3059\u3002\"
\u56f31. CFF Explorer\u3067\u898b\u305fBazarLoader\u306b\u306fIAT\u304c\u5b58\u5728\u3057\u306a\u3044<\/figcaption><\/figure>\n

\u5b9f\u969b\u3001BazarLoader\u306f\u5b9f\u884c\u6642\u306b\u500b\u5225\u306b\u547c\u3073\u51fa\u3059\u3053\u3068\u3067\u3059\u3079\u3066\u306eAPI\u95a2\u6570\u3092\u89e3\u6c7a\u3057\u3066\u3044\u307e\u3059\u3002\u95a2\u6570\u304c\u5b9f\u884c\u4e2d\u306b\u89e3\u6c7a\u3055\u308c\u308b\u3053\u3068\u304c\u308f\u304b\u3063\u305f\u5f8c\u3001\u6b21\u306e\u95a2\u6570\u304c300\u56de\u4ee5\u4e0a\u53c2\u7167\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u306b\u6ce8\u76ee\u3057\u307e\u3057\u305f\u3002<\/p>\n

\"\u3053\u3053\u306b\u793a\u3059\u3088\u3046\u306b\u3001BazarLoader\u306f\u5b9f\u884c\u6642\u306b\u500b\u5225\u306b\u547c\u3073\u51fa\u3059\u3053\u3068\u3067\u3059\u3079\u3066\u306eAPI\u95a2\u6570\u3092\u89e3\u6c7a\u3057\u3066\u3044\u308b
\u56f32. \u96e3\u8aad\u5316\u3055\u308c\u305fWindows API\u95a2\u6570\u3092\u89e3\u6c7a\u3059\u308b\u95a2\u6570(\u9ec4\u8272\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a)<\/figcaption><\/figure>\n

\u591a\u304f\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3067\u306f\u3088\u304f\u77e5\u3089\u308c\u3066\u3044\u308b\u30cf\u30c3\u30b7\u30e5\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3067\u95a2\u6570\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u89e3\u6c7a\u3057\u3066\u3044\u307e\u3059\u304c\u3001BazarLoader\u306e\u4f7f\u3046\u30cf\u30c3\u30b7\u30e5\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306f\u30e6\u30cb\u30fc\u30af\u3067\u3059\u3002API\u95a2\u6570\u306e\u89e3\u6c7a\u30d7\u30ed\u30b7\u30fc\u30b8\u30e3(sub_18000B9B0<\/span>\u3002FN_API_Decoder<\/span>\u306e\u30e9\u30d9\u30eb\u304c\u4ed8\u3051\u3089\u308c\u3066\u3044\u308b)\u306f\u30013\u3064\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u5fc5\u8981\u3068\u3057\u3001\u8981\u6c42\u3055\u308c\u305f\u95a2\u6570\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u8fd4\u3057\u307e\u3059\u3002<\/p>\n

\u3053\u3053\u3067FN_API_Decoder<\/span>\u3067\u4f7f\u308f\u308c\u3066\u3044\u308b\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3092\u30ea\u30d0\u30fc\u30b9\u30a8\u30f3\u30b8\u30cb\u30a2\u30ea\u30f3\u30b0\u3057\u3066Python\u3067\u518d\u5b9f\u88c5\u3059\u308c\u3070\u3001\u3059\u3079\u3066\u306e\u95a2\u6570\u3092\u89e3\u6c7a\u3067\u304d\u307e\u3059\u3002\u305f\u3060\u3053\u308c\u3067\u306f\u6642\u9593\u304c\u304b\u304b\u308a\u3059\u304e\u308b\u3057\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u4f7f\u3046\u30cf\u30c3\u30b7\u30e5\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u304c\u7570\u306a\u308c\u3070\u3001\u305d\u306e\u3064\u3069\u5168\u30d7\u30ed\u30bb\u30b9\u3092\u7e70\u308a\u8fd4\u3055\u306a\u3051\u308c\u3070\u306a\u308a\u307e\u305b\u3093\u3002<\/p>\n

\u305d\u3053\u3067\u79c1\u305f\u3061\u306f\u30cf\u30c3\u30b7\u30e5\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u304b\u3089\u72ec\u7acb\u3057\u305f\u30a2\u30d7\u30ed\u30fc\u30c1\u3092\u53d6\u308b\u3053\u3068\u306b\u3057\u307e\u3057\u305f\u3002\u30cf\u30c3\u30b7\u30e5\u95a2\u6570\u305d\u306e\u3082\u306e\u3092\u5229\u7528\u3059\u308b\u306e\u3067\u3059\u3002\u305d\u306e\u305f\u3081\u306b\u3001IDA Pro\u306eIDAPython\u304c\u3082\u3064Appcall<\/a>\u3068\u3044\u3046\u6a5f\u80fd\u3092\u4f7f\u3044\u3001FN_API_Decoder\u3092<\/span>\u547c\u3073\u51fa\u3057\u3066\u3001\u3053\u308c\u306b\u5fc5\u8981\u306a\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u6e21\u3057\u307e\u3057\u305f\u3002Appcall\u306e\u7d50\u679c\u306fWindows API\u95a2\u6570\u306e\u89e3\u6c7a\u6e08\u307f\u30a2\u30c9\u30ec\u30b9\u3068\u306a\u308a\u307e\u3059\u3002\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30c7\u30d0\u30c3\u30b0\u306b\u4f7f\u3063\u305fAppcall\u6a5f\u80fd\u3092\u4f7f\u3048\u3070\u3001\u30b5\u30f3\u30d7\u30eb\u5185\u306e\u4efb\u610f\u306e\u95a2\u6570\u3092\u7d44\u307f\u8fbc\u307f\u95a2\u6570\u306e\u3088\u3046\u306b\u5b9f\u884c\u3067\u304d\u307e\u3059\u3002<\/p>\n

\u4ee5\u4e0b\u306e\u30b3\u30fc\u30c9\u3092\u4f7f\u3046\u3068\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30d7\u30ed\u30bb\u30b9\u3092\u30c7\u30d0\u30c3\u30b0\u3057\u3064\u3064FN_API_Decoder<\/span>\u3092\u5b9f\u884c\u3057\u3066Windows API\u95a2\u6570\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u89e3\u6c7a\u3067\u304d\u307e\u3059\u3002<\/p>\n

\"\u3053\u306e\u30b3\u30fc\u30c9\u3092\u4f7f\u3046\u3068\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30d7\u30ed\u30bb\u30b9\u3092\u30c7\u30d0\u30c3\u30b0\u3057\u3064\u3064FN_API_Decoder\u3092\u5b9f\u884c\u3057\u3066Windows
\u56f33. IDAPython\u3067Appcall\u3092\u4f7f\u3046<\/figcaption><\/figure>\n

\u6b21\u306bFN_API_Decoder<\/span>\u3078\u306e\u30af\u30ed\u30b9\u30ea\u30d5\u30a1\u30ec\u30f3\u30b9\u3092\u3059\u3079\u3066\u8abf\u3079\u3001\u5fc5\u8981\u3068\u306a\u308b\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u305c\u3093\u3076\u96c6\u3081\u307e\u3057\u305f\u3002\u4ee5\u4e0b\u306e\u30b3\u30fc\u30c9\u306f\u3001API\u306e\u95a2\u6570\u547c\u3073\u51fa\u3057\u89e3\u6c7a\u306b\u5fc5\u8981\u306a\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u691c\u7d22\u30fb\u62bd\u51fa\u3059\u308b\u3082\u306e\u3067\u3059\u3002<\/p>\n

\"\u3053\u306e\u30b3\u30fc\u30c9\u306f\u3001API\u306e\u95a2\u6570\u547c\u3073\u51fa\u3057\u89e3\u6c7a\u306b\u5fc5\u8981\u306a\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u691c\u7d22\u30fb\u62bd\u51fa\u3059\u308b\u3082\u306e\u3067\u3059\u3002\"
\u56f34. 3\u3064\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u691c\u7d22\u30fb\u62bd\u51fa\u3059\u308bIDAPython\u306e\u30b3\u30fc\u30c9<\/figcaption><\/figure>\n

\u6700\u5f8c\u306b\u3001Appcall\u304b\u3089\u8fd4\u3055\u308c\u305f\u5024\u3092\u4f7f\u3048\u3070\u3001API\u3078\u306e\u52d5\u7684\u547c\u3073\u51fa\u3057\u3092\u3059\u3079\u3066\u5bfe\u5fdc\u3059\u308b\u540d\u524d\u306b\u5909\u66f4\u3057\u3001\u30b3\u30e1\u30f3\u30c8\u3082\u3064\u3051\u3089\u308c\u307e\u3059\u3002<\/p>\n

\"Appcall\u304b\u3089\u8fd4\u3055\u308c\u305f\u5024\u3092\u4f7f\u3048\u3070\u3001API\u3078\u306e\u52d5\u7684\u547c\u3073\u51fa\u3057\u3092\u3059\u3079\u3066\u5bfe\u5fdc\u3059\u308b\u540d\u524d\u306b\u5909\u66f4\u3057\u3001\u30b3\u30e1\u30f3\u30c8\u3082\u3064\u3051\u3089\u308c\u307e\u3059\u3002\"
\u56f35. IDAPython\u306e\u30b3\u30fc\u30c9\u3067\u52d5\u7684\u547c\u3073\u51fa\u3057\u3092\u691c\u7d22<\/figcaption><\/figure>\n

\u4ee5\u4e0a\u306e\u624b\u9806\u3092\u307e\u3068\u3081\u3066\u3001API\u306e\u95a2\u6570\u547c\u3073\u51fa\u3057\u306e\u96e3\u8aad\u5316\u3092\u89e3\u9664\u3067\u304d\u307e\u3057\u305f\u3002<\/p>\n

\"\u3053\u3053\u306b\u793a\u3059\u3088\u3046\u306b\u3001API\u306e\u95a2\u6570\u547c\u3073\u51fa\u3057\u306e\u96e3\u8aad\u5316\u3092\u89e3\u9664\u3059\u308b\u3053\u3068\u3067\u3001\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u306b\u5bfe\u5fdc\u3057\u307e\u3057\u305f\u3002
\u56f36. \u4e0a\u8a18IDAPython\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u5b9f\u884c\u524d<\/figcaption><\/figure>\n
\"API\u95a2\u6570\u547c\u3073\u51fa\u3057\u306e\u96e3\u8aad\u5316\u89e3\u9664\u306e\u7b2c2\u6bb5\u968e(\u540d\u524d\u3092\u5909\u66f4\u3057\u3066\u30b3\u30e1\u30f3\u30c8\u3092\u8ffd\u52a0)\"
\u56f37 API \u95a2\u6570\u547c\u3073\u51fa\u3057\u306e\u540d\u524d\u3092\u5909\u66f4\u3057\u3066\u30b3\u30e1\u30f3\u30c8\u3092\u8ffd\u52a0<\/figcaption><\/figure>\n

API\u95a2\u6570\u547c\u3073\u51fa\u3057\u306e\u540d\u524d\u3092\u3059\u3079\u3066\u5909\u66f4\u3057\u3066\u307f\u308b\u3068\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u542b\u307e\u308c\u3066\u3044\u308b\u307b\u304b\u306e\u8208\u5473\u6df1\u3044\u95a2\u6570\u304c\u7c21\u5358\u306b\u898b\u3064\u304b\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002\u305f\u3068\u3048\u3070sub_1800155E0<\/span>\u306fBazarLoader\u3067\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3092\u884c\u3046\u30d7\u30ed\u30b7\u30fc\u30b8\u30e3\u3067\u3059\u3002<\/p>\n

\"API\u95a2\u6570\u547c\u3073\u51fa\u3057\u306e\u540d\u524d\u3092\u3059\u3079\u3066\u5909\u66f4\u3057\u3066\u307f\u308b\u3068\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u542b\u307e\u308c\u3066\u3044\u308b\u307b\u304b\u306e\u8208\u5473\u6df1\u3044\u95a2\u6570\u304c\u7c21\u5358\u306b\u898b\u3064\u304b\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002\u305f\u3068\u3048\u3070sub_1800155E0\u306fBazarLoader\u3067\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3092\u884c\u3046\u30d7\u30ed\u30b7\u30fc\u30b8\u30e3\u3067\u3059\u3002\"
\u56f38 API\u547c\u3073\u51fa\u3057\u306e\u540d\u524d\u306e\u5909\u66f4\u524d<\/figcaption><\/figure>\n
\"\u3053\u3053\u306b\u793a\u3057\u305f\u3088\u3046\u306b\u3001\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u306b\u306fAPI\u547c\u3073\u51fa\u3057\u306e\u96e3\u8aad\u5316\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306b\u95a2\u9023\u3059\u308bAPI\u3067\u3042\u308b\u3068\u30e9\u30d9\u30eb\u3092\u4ed8\u3051\u3089\u308c\u3066\u3044\u307e\u3059\u3002\"
\u56f39 \u96e3\u8aad\u5316\u3092\u89e3\u9664\u3055\u308c\u3001\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u95a2\u9023\u306eAPI\u3067\u3042\u308b\u3068\u3057\u3066\u30e9\u30d9\u30eb\u4ed8\u3051\u3055\u308c\u305fAPI\u547c\u3073\u51fa\u3057<\/figcaption><\/figure>\n

\u3053\u308c\u3089\u306eIDAPython\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u304a\u304b\u3052\u3067\u3053\u306eBazarLoader\u30b5\u30f3\u30d7\u30eb\u304c\u3069\u306e\u3088\u3046\u306a\u6a5f\u80fd\u3092\u542b\u3093\u3067\u3044\u308b\u304b\u3092\u3059\u3070\u3084\u304f\u8a55\u4fa1\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n

\u300c\u4e0d\u900f\u660e\u8ff0\u8a9e\u300d\u306e\u9664\u53bb\u3092\u81ea\u52d5\u5316\u3059\u308b<\/strong><\/h2>\n

BazarLoader\u306b\u306f\u3001\u30ea\u30d0\u30fc\u30b9\u30a8\u30f3\u30b8\u30cb\u30a2\u30ea\u30f3\u30b0\u30c4\u30fc\u30eb\u304b\u3089\u306e\u4fdd\u8b77\u306e\u305f\u3081\u306bOP(Opaque Predicate\u3001\u4e0d\u900f\u660e\u8ff0\u8a9e)\u304c\u4f7f\u308f\u308c\u3066\u3044\u307e\u3059\u3002OP\u306f\u5b9f\u884c\u6642\u306b\u3064\u306d\u306btrue<\/span>\u307e\u305f\u306ffalse<\/span>\u306b\u8a55\u4fa1\u3055\u308c\u308b\u5f0f\u306e\u3053\u3068\u3067\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u4f5c\u6210\u8005\u306f\u3053\u3046\u3057\u305f\u8907\u6570\u306eOP\u3092\u5b9f\u884c\u3055\u308c\u308b\u3053\u3068\u306e\u306a\u3044\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af\u3068\u3068\u3082\u306b\u8ffd\u52a0\u3057\u3066\u30b3\u30fc\u30c9\u3092\u8907\u96d1\u5316\u306b\u3059\u308b\u3053\u3068\u3067\u3001\u9759\u7684\u89e3\u6790\u30c4\u30fc\u30eb\u304c\u51e6\u7406\u3057\u3065\u3089\u3044\u3088\u3046\u306b\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

\u4ee5\u4e0b\u306e\u9006\u30a2\u30bb\u30f3\u30d6\u30eb\u6e08\u307f\u30b3\u30fc\u30c9\u306fBazarloader\u306eOP\u306e1\u3064\u3092\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n

\"\u3053\u3053\u306b\u793a\u3059\u9006\u30a2\u30bb\u30f3\u30d6\u30eb\u6e08\u307f\u30b3\u30fc\u30c9\u306f\u3001BazarLoader\u304c\u30ea\u30d0\u30fc\u30b9\u30a8\u30f3\u30b8\u30cb\u30a2\u30ea\u30f3\u30b0\u30c4\u30fc\u30eb\u304b\u3089\u306e\u4fdd\u8b77\u306b\u4f7f\u3046OP\u306e1\u3064\u3067\u3001\u672c\u7a3f\u3067\u89e3\u8aac\u3059\u308b\u4e00\u822c\u7684\u306a\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u306e1\u3064\u3067\u3059\u3002
\u56f310 BazarLoader\u306eOP\u306e\u4e00\u4f8b<\/figcaption><\/figure>\n

\u4e0a\u8a18\u306e\u5236\u5fa1\u30d5\u30ed\u30fc\u30b0\u30e9\u30d5(CFG)\u3067\u306f\u3001\u30b3\u30fc\u30c9\u30d5\u30ed\u30fc\u304c\u7121\u9650\u30eb\u30fc\u30d7\u306b\u9665\u308b\u3053\u3068\u306f\u3042\u308a\u307e\u305b\u3093(\u56f310\u8d64\u3067\u793a\u3057\u305f\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af)\u3002\u3064\u307e\u308a\u4e0a\u8a18\u306eOP\u3092\u8a55\u4fa1\u3059\u308b\u3053\u3068\u306b\u3088\u308a\u7121\u9650\u30eb\u30fc\u30d7\u3092\u56de\u907f\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

\u3053\u3046\u3057\u305fOP\u304c\u30de\u30eb\u30a6\u30a7\u30a2\u30a2\u30ca\u30ea\u30b9\u30c8\u306b\u3082\u305f\u3089\u3059\u56f0\u96e3\u304c\u3069\u306e\u3088\u3046\u306a\u3082\u306e\u304b\u3092\u304a\u898b\u305b\u3057\u307e\u3057\u3087\u3046\u3002\u4ee5\u4e0b\u306eCFG\u306f\u3001\u30b5\u30f3\u30d7\u30eb\u4e2d\u306e\u5c0f\u3055\u306a\u95a2\u6570\u306e1\u3064(sub_18000F640<\/span>)\u306b\u542b\u307e\u308c\u308b\u5b9f\u884c\u3055\u308c\u308b\u3053\u3068\u306e\u306a\u3044\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af(\u56f311 \u8d64\u3067\u793a\u3059\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af)\u3092\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n

\"\u5236\u5fa1\u30d5\u30ed\u30fc\u30b0\u30e9\u30d5\u5185\u306e\u8d64\u3067\u793a\u3057\u305f\u30d6\u30ed\u30c3\u30af\u306f\u3001\u30b5\u30f3\u30d7\u30eb\u306b\u542b\u307e\u308c\u308b\u5c0f\u3055\u306a\u95a2\u6570\u306e1\u3064\u5185\u306e\u5b9f\u884c\u3055\u308c\u308b\u3053\u3068\u306e\u306a\u3044\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af\u3092\u793a\u3057\u305f\u3082\u306e\u3067\u3059\u3002
\u56f311 BazarLoader\u306esub_18000F640\u95a2\u6570\u3002\u5b9f\u884c\u3055\u308c\u308b\u3053\u3068\u306e\u306a\u3044\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af\u304c\u8d64\u8272\u3067\u8868\u793a\u3055\u308c\u3066\u3044\u308b<\/figcaption><\/figure>\n

\u30b5\u30f3\u30d7\u30eb\u5185\u306e\u5404\u95a2\u6570\u3092\u89e3\u6790\u3057\u3064\u3064\u5b9f\u884c\u3055\u308c\u306a\u3044\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af\u3092\u624b\u3067\u4fee\u6b63\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u306a\u304f\u306f\u306a\u3044\u3067\u3059\u304c\u3001\u6642\u9593\u3082\u304b\u304b\u308b\u3057\u3042\u307e\u308a\u73fe\u5b9f\u7684\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u305d\u3053\u3067\u3001\u3053\u306e\u51e6\u7406\u3092\u81ea\u52d5\u5316\u3059\u308b\u3068\u3044\u3046\u3082\u3063\u3068\u30b9\u30de\u30fc\u30c8\u306a\u65b9\u6cd5\u3092\u9078\u3076\u3053\u3068\u306b\u3057\u307e\u3059\u3002<\/p>\n

\u307e\u305a\u3001\u3059\u3079\u3066\u306eOP\u306e\u4f4d\u7f6e\u3092\u7279\u5b9a\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u3044\u3061\u3070\u3093\u4e00\u822c\u7684\u306a\u306e\u306fIDA Pro\u306e\u30d0\u30a4\u30ca\u30ea\u30b5\u30fc\u30c1\u306e\u30e1\u30ab\u30cb\u30ba\u30e0\u3067OP\u306e\u5168\u30d0\u30a4\u30c8\u30b7\u30fc\u30b1\u30f3\u30b9\u3092\u898b\u3064\u3051\u308b\u65b9\u6cd5\u3067\u3059\u3002\u305f\u3060\u3053\u306e\u65b9\u6cd5\u306f\u3001\u30b3\u30f3\u30d1\u30a4\u30e9\u304c\u30de\u30eb\u30a6\u30a7\u30a2\u30b5\u30f3\u30d7\u30eb\u306e\u30d3\u30eb\u30c9\u6642\u306bOP\u3092\u751f\u6210\u3057\u305f\u3089\u3057\u3044\u3053\u3068\u304b\u3089\u3001\u4f7f\u3048\u306a\u3044\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002OP\u306e\u30d0\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u304c\u591a\u3059\u304e\u3066\u30d0\u30a4\u30c8\u30b7\u30fc\u30b1\u30f3\u30b9\u3067\u306f\u5bfe\u5fdc\u3057\u304d\u308c\u306a\u3044\u306e\u3067\u3059\u3002<\/p>\n

\u307e\u305f\u3001\u79c1\u305f\u3061\u306f\u3001OP\u306e\u4f4d\u7f6e\u3092\u7279\u5b9a\u3059\u308b\u3060\u3051\u3067\u306a\u304f\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u30b5\u30f3\u30d7\u30eb\u304c\u5b9f\u884c\u3057\u306a\u3044\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af\u306e\u56de\u907f\u3092\u6c7a\u3081\u308b\u6b63\u78ba\u306a\u30dd\u30a4\u30f3\u30c8\u3082\u77e5\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3057\u305f\u3002<\/p>\n

\u305d\u3053\u3067\u4ee5\u4e0b\u306e\u30b3\u30fc\u30c9\u3067\u3001\u95a2\u6570\u5185\u306eOP\u306e\u4f4d\u7f6e\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002<\/p>\n

\"\u79c1\u305f\u3061\u306f\u3001OP\u306e\u4f4d\u7f6e\u3092\u7279\u5b9a\u3059\u308b\u3060\u3051\u3067\u306a\u304f\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u30b5\u30f3\u30d7\u30eb\u304c\u5b9f\u884c\u3057\u306a\u3044\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af\u306e\u56de\u907f\u3092\u6c7a\u3081\u308b\u6b63\u78ba\u306a\u30dd\u30a4\u30f3\u30c8\u3082\u77e5\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3057\u305f\u3002\u3053\u3053\u3067\u7d39\u4ecb\u3059\u308b\u30b3\u30fc\u30c9\u3067\u3001\u95a2\u6570\u5185\u3067\u306eOP\u306e\u4f4d\u7f6e\u3092\u7279\u5b9a\u3067\u304d\u307e\u3059\u3002
\u56f312. \u95a2\u6570\u5185\u306eOP\u3092\u691c\u7d22\u3059\u308bIDAPython\u30b3\u30fc\u30c9<\/figcaption><\/figure>\n

\u6b21\u306b\u3001OP\u306e\u547d\u4ee4\u3092\u4fee\u6b63\u3057\u3001\u5b9f\u884c\u3055\u308c\u306a\u3044\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af\u304b\u3089\u5f37\u5236\u7684\u306b\u30b3\u30fc\u30c9\u306e\u30d5\u30ed\u30fc\u3092\u5f15\u304d\u96e2\u3059\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n

\u305d\u3053\u3067\u79c1\u305f\u3061\u306f\u3001\u4ee5\u4e0b\u306e\u30b3\u30fc\u30c9\u3067\u95a2\u6570\u5185\u306eOP\u3092\u4fee\u6b63\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

\"\u3053\u3053\u3067\u793a\u3059\u30b3\u30fc\u30c9\u306f\u3001OP\u306e\u547d\u4ee4\u3092\u4fee\u6b63\u3057\u3001\u5b9f\u884c\u3055\u308c\u306a\u3044\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af\u304b\u3089\u5f37\u5236\u7684\u306b\u30b3\u30fc\u30c9\u306e\u30d5\u30ed\u30fc\u3092\u5f15\u304d\u96e2\u3057\u3066\u3044\u307e\u3059\u3002
\u56f313. OP\u3092\u4fee\u6b63\u3059\u308bIDAPython\u30b3\u30fc\u30c9<\/figcaption><\/figure>\n

\u3053\u308c\u3089\u306eOP\u306fHexRays\u30c7\u30b3\u30f3\u30d1\u30a4\u30e9\u306e\u51fa\u529b\u3082\u3044\u3058\u3063\u3066\u3044\u307e\u3059\u3002OP\u4fee\u6b63\u524d\u306e\u95a2\u6570(sub_18000F640<\/span>)\u306f\u3053\u3093\u306a\u5185\u5bb9\u3067\u3057\u305f\u3002<\/p>\n

\"\u3053\u306e\u56f3\u306fOP\u4fee\u6b63\u524d\u306e\u95a2\u6570(sub_18000F640)\u306e\u69d8\u5b50\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002
\u56f314 \u9006\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u305f\u95a2\u6570 sub_18000F640<\/figcaption><\/figure>\n

\u4e0a\u8a182\u3064\u306e\u6280\u8853\u3092\u9069\u7528\u3057\u305f\u7d50\u679c\u3001\u8aad\u307f\u3084\u3059\u304f\u308f\u304b\u308a\u3084\u3059\u3044\u64ec\u4f3c\u30b3\u30fc\u30c9\u306b\u9006\u30b3\u30f3\u30d1\u30a4\u30eb\u3067\u304d\u307e\u3057\u305f\u3002<\/p>\n

\u3059\u3079\u3066\u306eOP\u3092\u4fee\u6b63\u3057\u3066\u96e3\u8aad\u5316\u3055\u308c\u305fAPI\u547c\u3073\u51fa\u3057\u306e\u540d\u524d\u3092\u5909\u66f4\u3057\u3066\u307f\u308b\u3068\u3001\u3053\u306e\u95a2\u6570(sub_18000F640<\/span>)\u304cGetModuleFileNameW(<\/span>)\u306e\u5358\u306a\u308b\u30e9\u30c3\u30d1\u30fc\u95a2\u6570\u3067\u3042\u308b\u3053\u3068\u304c\u5206\u304b\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n

\"\u4e0a\u8a182\u3064\u306e\u6280\u8853\u3092\u9069\u7528\u3057\u3066\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u3063\u3066\u307f\u308b\u3068\u3001\u8aad\u307f\u3084\u3059\u304f\u3066\u308f\u304b\u308a\u3084\u3059\u3044\u64ec\u4f3c\u30b3\u30fc\u30c9\u306b\u9006\u30b3\u30f3\u30d1\u30a4\u30eb\u3067\u304d\u307e\u3057\u305f\u3002
\u56f315. OP\u524a\u9664\u5f8c\u306b\u9006\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u305f\u95a2\u6570 sub_18000F640<\/figcaption><\/figure>\n

<\/a>\u30de\u30eb\u30a6\u30a7\u30a2\u30a2\u30ca\u30ea\u30b9\u30c8\u5bfe\u30de\u30eb\u30a6\u30a7\u30a2\u4f5c\u6210\u8005<\/h2>\n

\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u4f5c\u6210\u8005\u305f\u3061\u306f\u3001\u89e3\u6790\u306b\u304b\u304b\u308b\u6642\u9593\u3084\u30ea\u30bd\u30fc\u30b9\u3092\u5897\u3084\u3057\u3066\u3084\u308d\u3046\u3068\u3001\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u76db\u308a\u8fbc\u3093\u3067\u304f\u308b\u3053\u3068\u304c\u5c11\u306a\u304f\u3042\u308a\u307e\u305b\u3093\u3002\u3053\u3046\u3057\u305f\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u308b\u65b9\u6cd5\u3092\u793a\u3057\u305fBazarLoader\u7528\u306e\u4e0a\u8a18\u30b9\u30af\u30ea\u30d7\u30c8\u30b9\u30cb\u30da\u30c3\u30c8\u3092\u4f7f\u3048\u3070\u3001\u4f3c\u305f\u3088\u3046\u306a\u6280\u8853\u3092\u4f7f\u3046\u307b\u304b\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u30d5\u30a1\u30df\u30ea\u30b5\u30f3\u30d7\u30eb\u306e\u5206\u6790\u306b\u5fc5\u8981\u306a\u6642\u9593\u3092\u77ed\u7e2e\u3067\u304d\u307e\u3059\u3002<\/p>\n

\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001Cortex XDR\u307e\u305f\u306fWildFire\u3068\u8105\u5a01\u9632\u5fa1\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b5\u30d6\u30b9\u30af\u30ea\u30d7\u30b7\u30e7\u30f3\u3092\u6709\u52b9\u306b\u3057\u305f\u6b21\u4e16\u4ee3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u306b\u3088\u308a\u3001\u540c\u69d8\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u4f7f\u7528\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u30d5\u30a1\u30df\u30ea\u304b\u3089\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n

<\/a>IoC<\/h2>\n

BazarLoader\u306e\u30b5\u30f3\u30d7\u30eb: ce5ee2fd8aa4acda24baf6221b5de66220172da0eb312705936adc5b164cc052<\/span><\/p>\n

<\/a>\u8ffd\u52a0\u30ea\u30bd\u30fc\u30b9<\/h2>\n

\u96e3\u8aad\u5316\u3055\u308c\u305fAPI\u547c\u3073\u51fa\u3057\u306e\u540d\u524d\u5909\u66f4\u30fb\u89e3\u6c7a\u3092\u884c\u3046\u5b8c\u5168\u306aIDAPython\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3053\u3061\u3089\u306eGitHub<\/a>\u3067\u516c\u958b\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

\u95a2\u6570\u5185\u306e\u4e0d\u900f\u660e\u8ff0\u8a9e\u3092\u691c\u7d22\u3057\u3066\u4fee\u6b63\u3059\u308b\u5b8c\u5168\u306aIDAPython\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3053\u3061\u3089\u306eGitHub<\/a>\u3067\u516c\u958b\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

\u6982\u8981 \u30de\u30eb\u30a6\u30a7\u30a2\u4f5c\u6210\u8005\u306f\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u3044\u304f\u3064\u3082\u30b3\u30fc\u30c9\u306b\u57cb\u3081\u8fbc\u3093\u3067\u4eba\u9593\u306e\u30a2\u30ca\u30ea\u30b9\u30c8\u3084\u30b5\u30f3\u30c9\u30dc\u30c3\u30af\u30b9\u5206\u6790\u30d7\u30ed\u30bb\u30b9\u3092\u90aa\u9b54\u3057\u3066\u304d\u307e\u3059\u304c\u3001\u9632\u5fa1\u5074\u306b\u3082\u305d\u3046\u3057\u305f\u6280\u8853\u3092\u6253\u3061\u7834\u308b\u6280\u8853\u306f\u3042\u308a\u307e\u3059\u3002\u672c\u7a3f\u306f\u7279\u5fb4\u7684\u306a\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u30922\u70b9\u63a1\u7528\u3057\u3066\u3044\u308b<\/p>\n","protected":false},"author":311,"featured_media":134334,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4321,1974,4428],"tags":[5366,5349],"product_categories":[4346,4442,4444,4448,4456],"coauthors":[1355],"class_list":["post-122850","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-research","category-malware-ja","category-threat-research-ja","tag-anti-analysis","tag-bazarloader-ja","product_categories-advanced-threat-prevention","product_categories-advanced-threat-prevention-ja","product_categories-advanced-wildfire-ja","product_categories-cortex-xdr-ja","product_categories-next-generation-firewall-ja"],"yoast_head":"\nBazarLoader\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u308b<\/title>\n<meta name=\"description\" content=\"\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u4f7f\u3046\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u89e3\u6790\u306f\u305d\u3046\u3067\u306a\u3044\u3082\u306e\u3088\u308a\u96e3\u3057\u3044\u3067\u3059\u304c\u3001\u305d\u3046\u3057\u305f\u5bfe\u7b56\u3092\u6253\u3061\u7834\u308b\u305f\u3081\u306e\u6280\u8853\u3082\u3042\u308a\u307e\u3059\u3002\u4eca\u56de\u306fBazarLoader\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u4f8b\u306b\u3068\u308a\u3001\u540c\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u88532\u3064\u3092\u7834\u308b2\u3064\u306e\u65b9\u6cd5\u3092\u7d39\u4ecb\u3057\u307e\u3059\u3002\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"BazarLoader\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u308b\" \/>\n<meta property=\"og:description\" content=\"\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u4f7f\u3046\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u89e3\u6790\u306f\u305d\u3046\u3067\u306a\u3044\u3082\u306e\u3088\u308a\u96e3\u3057\u3044\u3067\u3059\u304c\u3001\u305d\u3046\u3057\u305f\u5bfe\u7b56\u3092\u6253\u3061\u7834\u308b\u305f\u3081\u306e\u6280\u8853\u3082\u3042\u308a\u307e\u3059\u3002\u4eca\u56de\u306fBazarLoader\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u4f8b\u306b\u3068\u308a\u3001\u540c\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u88532\u3064\u3092\u7834\u308b2\u3064\u306e\u65b9\u6cd5\u3092\u7d39\u4ecb\u3057\u307e\u3059\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2022-04-26T00:55:56+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-04-26T01:04:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/07_Malware_Category_1920x900.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mark Lim\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"BazarLoader\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u308b","description":"\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u4f7f\u3046\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u89e3\u6790\u306f\u305d\u3046\u3067\u306a\u3044\u3082\u306e\u3088\u308a\u96e3\u3057\u3044\u3067\u3059\u304c\u3001\u305d\u3046\u3057\u305f\u5bfe\u7b56\u3092\u6253\u3061\u7834\u308b\u305f\u3081\u306e\u6280\u8853\u3082\u3042\u308a\u307e\u3059\u3002\u4eca\u56de\u306fBazarLoader\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u4f8b\u306b\u3068\u308a\u3001\u540c\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u88532\u3064\u3092\u7834\u308b2\u3064\u306e\u65b9\u6cd5\u3092\u7d39\u4ecb\u3057\u307e\u3059\u3002","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/","og_locale":"ja_JP","og_type":"article","og_title":"BazarLoader\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u308b","og_description":"\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u4f7f\u3046\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u89e3\u6790\u306f\u305d\u3046\u3067\u306a\u3044\u3082\u306e\u3088\u308a\u96e3\u3057\u3044\u3067\u3059\u304c\u3001\u305d\u3046\u3057\u305f\u5bfe\u7b56\u3092\u6253\u3061\u7834\u308b\u305f\u3081\u306e\u6280\u8853\u3082\u3042\u308a\u307e\u3059\u3002\u4eca\u56de\u306fBazarLoader\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u4f8b\u306b\u3068\u308a\u3001\u540c\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u88532\u3064\u3092\u7834\u308b2\u3064\u306e\u65b9\u6cd5\u3092\u7d39\u4ecb\u3057\u307e\u3059\u3002","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/","og_site_name":"Unit 42","article_published_time":"2022-04-26T00:55:56+00:00","article_modified_time":"2022-04-26T01:04:03+00:00","og_image":[{"width":1920,"height":900,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/07_Malware_Category_1920x900.jpg","type":"image\/jpeg"}],"author":"Mark Lim","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/"},"author":{"name":"Mark Lim","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/aca5a3f44ee88bf488b573d58a382eba"},"headline":"BazarLoader\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u308b","datePublished":"2022-04-26T00:55:56+00:00","dateModified":"2022-04-26T01:04:03+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/"},"wordCount":269,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/#primaryimage"},"thumbnailUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/07_Malware_Category_1920x900.jpg","keywords":["anti-analysis","BazarLoader"],"articleSection":["Threat Research","\u30de\u30eb\u30a6\u30a7\u30a2","\u8105\u5a01\u30ea\u30b5\u30fc\u30c1"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/","name":"BazarLoader\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u308b","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/#primaryimage"},"thumbnailUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/07_Malware_Category_1920x900.jpg","datePublished":"2022-04-26T00:55:56+00:00","dateModified":"2022-04-26T01:04:03+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/aca5a3f44ee88bf488b573d58a382eba"},"description":"\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u4f7f\u3046\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u89e3\u6790\u306f\u305d\u3046\u3067\u306a\u3044\u3082\u306e\u3088\u308a\u96e3\u3057\u3044\u3067\u3059\u304c\u3001\u305d\u3046\u3057\u305f\u5bfe\u7b56\u3092\u6253\u3061\u7834\u308b\u305f\u3081\u306e\u6280\u8853\u3082\u3042\u308a\u307e\u3059\u3002\u4eca\u56de\u306fBazarLoader\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u4f8b\u306b\u3068\u308a\u3001\u540c\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u88532\u3064\u3092\u7834\u308b2\u3064\u306e\u65b9\u6cd5\u3092\u7d39\u4ecb\u3057\u307e\u3059\u3002","breadcrumb":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/#primaryimage","url":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/07_Malware_Category_1920x900.jpg","contentUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/07_Malware_Category_1920x900.jpg","width":1920,"height":900,"caption":"A digital concept showing a large malware alert symbol on a screen, set against a background filled with lines of computer code and network diagrams in shades of blue and pink. The word \"MALWARE\" prominently displayed within the alert symbol."},{"@type":"BreadcrumbList","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/bazarloader-anti-analysis-techniques\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/unit42.paloaltonetworks.com\/ja\/"},{"@type":"ListItem","position":2,"name":"BazarLoader\u306e\u89e3\u6790\u5bfe\u7b56\u6280\u8853\u3092\u7834\u308b"}]},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/aca5a3f44ee88bf488b573d58a382eba","name":"Mark Lim","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/9213e49ea48b7676660bac40d05c9e3e","url":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","contentUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","caption":"Mark Lim"},"url":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/author\/mark-lim\/"}]}},"_links":{"self":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/122850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/311"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=122850"}],"version-history":[{"count":3,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/122850\/revisions"}],"predecessor-version":[{"id":122854,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/122850\/revisions\/122854"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/134334"}],"wp:attachment":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=122850"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=122850"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=122850"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=122850"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=122850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}