声明：本公众号所发文章及工具，仅用于学习和研究目的，且不能违反《网络安全法》、《刑法》等相关要求，尤其禁止传播，或用于非善良目的。您浏览本公众号文章，即视为遵守以上约定，否则责任自负。
今日导读：流量e魔病毒分析报告、Buran勒索病毒传入我国，用户宜小心处理不明邮件、AtherosSvc注册中心LPE分析、Simjacker技术分析报告、PDF调试技巧剖析、狩猎内存分配错误、IDAPython Cheatsheets（7.x和6.x）等。
【病毒区】
1、叙利亚电子军揭秘：管窥网络攻击在叙利亚内战中的作用与影响
http://blogs.360.cn/post/Syrian_Electronic_Army.html
2、流量e魔病毒分析报告
https://www.freebuf.com/articles/terminal/215168.html
3、Buran勒索病毒传入我国，用户宜小心处理不明邮件
https://mp.weixin.qq.com/s/jm7Q9JvsdUzfv5xELXMJ9Q
4、PcShare Backdoor Attacks Targeting Windows Users with FakeNarrator Malware
https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html
5、Icon-hiding Android adware returns to the Play Market
https://news.sophos.com/en-us/2019/10/08/icon-hiding-android-adware-returns-to-the-play-market/
6、Casbaneiro: Dangerous cooking with a secret ingredient
https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/
【漏洞分析区】
7、CVE-2019-10617 – AtherosSvc Registry LPE
https://silentbreaksecurity.com/cve-2019-10617/
8、Simjacker技术分析报告
https://www.anquanke.com/post/id/188110
【技术分享区】
9、PDF调试技巧剖析
https://www.anquanke.com/post/id/188138
10、Pentesting an IOT based Biometric Attendance device
https://medium.com/bugbountywriteup/pentesting-an-iot-based-biometric-attendance-device-10c0efd69392
11、Reflective DLL Injection
https://ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
12、Zero-Day Snafus — Hunting Memory Allocation Bugs
https://securityboulevard.com/2019/10/zero-day-snafus%e2%80%8a-%e2%80%8ahunting-memory-allocation-bugs/
13、Android 中的特殊攻击面（一）——邪恶的对话框
https://mp.weixin.qq.com/s/mN5M9-P0g6x_4NqTKbO2Sg
14、Mapping Windows API’s to Sysmon Events
https://posts.specterops.io/uncovering-the-unknowns-a47c93bb6971
15、Cheatsheets and example scripts for IDAPython (7.x and 6.x).
https://github.com/inforion/idapython-cheatsheet
#工具#The Memory Process File System is an easy and convenient way of accessing physical memory as files a virtual file system.
https://github.com/ufrisk/MemProcFS
