Note : This is the continuation to my previous post on VirtualAlloc function, click here to refer.
RtlMoveMemory function copies the contents of the payload to the destination memory block/buffer.
The syntax of the function is,
VOID RtlMoveMemory(
_Out_ VOID UNALIGNED *Destination,
_In_ const VOID UNALIGNED *Source,
_In_ SIZE_T Length
);
Destination : To where to copy the payload.
Source : From where to copy the payload.
Length : Size of the payload.
Example :
char payload[] ={0x90,0x90};
int payload_size=2;
mem = VirtualAlloc(0,payload_size,MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); // Create and allocate a memory buffer
RtlMoveMemory(mem,payload,payload_size)
Reference :
https://docs.microsoft.com/en-us/windows/win32/devnotes/rtlmovememory
When you do malware analysis of documents or office files, it is important to have Microsoft Office installed in your Lab machine. I am using flare VM and it doesn't comes with MS Office. Since Microsoft is promoting Microsoft 365 over the offline version, finding the offline installer is not that easy. Here is the list of genuine Microsoft links to download the office .img files. Download Microsoft Office 2019 Professional Plus : https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/ProPlus2019Retail.img Download Microsoft Office 2019 Professional : https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/Professional2019Retail.img Download Microsoft Office 2019 Home and Business : https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-US/HomeBusiness2019Retail.img Download Microsoft Office 2019 Home and Student : https://officecdn.microsoft.com/db/492350F6-3A01-4F97-B9C0-C7C6DDF67D60/media/en-U...