It's Thursday morning. I'm Jay Fardell. It's Think Tech and more than that's Community Matters. And we are joined today by Zoom, by Derwin Leyva. Derwin is an artist here in Honolulu. Good morning, Derwin. Hey, good morning. Glad to be here. Okay. You're my favorite artist actually here in Honolulu. Thanks. I appreciate it. So we wanted to find out how COVID has affected you because it's affected everybody. It's certainly affected us. We've learned a lot here at Think Tech. We've improved some systems. We've extended our range to people all over the world.  Anyway, so I wanted to know how it's affecting you. I know you spend your time in the studio and you create and you think and you have these moments of creativity that result in the beautiful paintings you do. But tell us how your life has changed. Well, the part that affected me the most is the exhibitions and the show because now look to the problem that we have in everything is being canceled. I had a show in April in New York and that was canceled. That was postponed to October, maybe to April next year. Then I had another exhibition in Milan in Italy and that one got postponed. I had another exhibition in Rome, which also got postponed. So pretty much all the art shows around the world has been canceled or has been postponed for a later day. So that's how mostly have affected me, which, you know, there is probably not going to be any show this year. So that will give me more time to work in the studio and definitely next year are going to have a lot of painting to show. Oh, okay. Well, maybe it's not all bad, but what does it mean to you in terms of the development of your art, your reputation, your art sales to have all these exhibitions canceled or delayed possibly indefinitely? What does that mean to your career as an artist? Well, I mean, you know, I don't think that is, I always try to look at the positive things. Like right now, I'm not going to be doing the show.  I spend more time in the studio now. So I'm definitely getting prepared for, but I also have affected the way that I'm painting right now because a lot of my work, I always include a lot of people. That's one of the main subject music and people in my paintings. But then later that I'm here at home, and I start working on things that I see around the house. So I start doing some still life, and I start working on some paintings. I do a lot of the cityscape, but then I don't put people in it because whenever I go out to the street, I walk around the neighborhood, all I see is the houses. So everything is empty. I start incorporating some of that into my paintings, a lot of the painting that I don't know how they're just the cityscape. And I put some musical instruments in there, but then that becomes the space for the viewer so they can jump into that cityscape and walk through because there is nobody there in the painting. It's just the cityscape. And then I started a new series of painting around my house. So like right now, I started working at Big Canvas, the one that I have in my background. That one is five feet by four feet. And so I'm using elements of my house, different areas of my house to do this kind of like sequence of paintings that I'm going to be doing. And he's all like sitting in my house and then different areas. And all of them going to have like a window, a balcony. We have viewed to a different part of the world because that's what I see every day. Even though that I'm inside my house, I still can see friends, Italy, all these other parts of the world that I want to visit or I want to be there. So I'm going to be putting this into my paintings and then I'm going to be doing it from every area of my house. So your whole world has changed and you're visual in the sense that you really need to have the visual stimulation of the people, the places, and so forth.  I find that very interesting. You don't do it by recollection, you do it by what is there now, today, right now. Yes, yes. I mean, I try to incorporate a lot of things of the life, you know, like the daily life into my paintings. Anything that happened to me, like I always incorporate into the paintings. So I want to unpack on a couple of things before you go. You talked about interview people, yeah? It's not just looking at them, it's talking to them. You want to have a conversation with someone personal and use that as a material for your creativity. Am I right? Yes, yes, I do. So what is that? You need to be with the person.  You need to stand on the street corner and look at them and have a conversation. Is that, what do you need to have an interview? Oh, I mean, not, I mean, I would not call it exactly, it's an interview, but like a lot of the times when I talk to people and, you know, having a conversation and I get an impression from that person could be, you know, any specific thing about that person, you know, maybe the hair is something that caught my attention or, or, you know, the way that a person talks, things like that, that I try to incorporate into the painting. So I get elements from that, just from talking to people.  So give me that feedback. Then automatically I incorporate in the next painting, I start putting into my paintings, everything that they tell me, that they, you know, I never saw before, and then I just start putting into the paintings. So that's, that's what I love talking about with the people. But what about Zoom? What about Zoom? What about having conversations on Zoom? I, I suspect you're not having that many conversations on Zoom, but do you spend time with Zoom? Well, I start doing a class, kind of like a class, we're not a class, but getting together, we, a lot of artists, and we do it every Wednesday. And we spend like about three hours together in the studio. So we can see everybody's work, we can talk about everybody's work. And then that way we kind of give each other feedback and everybody can see what the other artists are doing. And you get inspiration from that too, eh? Yeah, yeah. That's another way for me to get feedback on my work, you know, the point, things that, you know, they see different that I don't see, and then I, you know, I incorporate into my work or not. A footnote to that, when is that later on today? We have chamber music, Hawaii is going to come around. And so what do you do with a chamber orchestra? What do you do with a string quartet? What do you do if they're not actually together? Well, you have everyone on his own Zoom. And they play together because they can all hear each other and they play together and it's really beautiful. And I would hesitate to say that it's almost as good as if they played in person. And so it's this collaboration among the members of the, of the chamber music group that allows, on Zoom, that allows them to continue, you know, in their, in their creativity. And so it's the same thing with you.  You learn from that. You, as a result, you have, you have a process that may be different, maybe arguably even better than, see, I have to turn on the chat here because, because there's a question and I need to get the question. Ah, okay. Yeah, I have a question for you. Okay. Question for the host to ask, why isn't art categorized as essential business in crisis times? Oh, there's a very interesting question. I guess you're not characterized as essential. And what does that mean to you, Der? What's a good question? What does that mean to you in terms of your business? That is definitely a good question. I didn't think about it until you mentioned it now, but normally we're used to, you know, the public system, the schools, whenever they have a problem with a budget or anything like that, usually the first thing that goes is the art department or things like that that they consider not essential, you know, music, art. But I will argue that probably that's one of the most essential things for human life, you know, because people that don't have art, don't have music, you know, they are like the most saddest people in the world.  And a lot of the time, the reason why we study different cultures is because they are, you know, it's not because of the essential business of selling fruits or anything like that is because of the art. Yeah. So what do they say? A great state deserves great art. A great community, a great society deserves great art. And it's sometimes it's hard to put that in words, but there you go. And so, you know, the idea of not being able to get out as you would, not being able to have the impressions and the stimulations as you would. Does that change your art now? Being indoors all the time? Does that change your art? Is it the same? Is it better or worse? How do you compare it with the ordinary times? Well, definitely the whole thing with being inside the house have changed. I think I would say that have opened my, you know, my view, the way that I see art now, because now I'm trying different things that I didn't try before, like, you know, like doing a still life. That's something that I was not attracted to. And now that I'm inside the house, I'm not seeing a lot of the people and things like that. Then I decided, well, I got to paint objects around the house. And when I see something, oh, okay, I like that. I got to put it into my painting. So I start getting more involved with the still life. And like I say, when I do the cityscapes, then I'm not putting any people in it, because when I walk around my house in the neighborhood, I don't see anybody. It's always empty. So that's what I'm doing. And that's how I have influenced my art. Yeah, so it strikes me that when they write the books about you, Terwin, this will be your COVID period. It's a new period in the development of your art. You have new influences, new orientation, though. You feel it? Yeah. And I think that will be my subject for next year. So right now, the next show that I have planned, which I don't know if it's going to happen, but I was invited to the Biennale in Buenos Aires, Argentina. And that's going to be in October. So I don't know if that's going to still going to happen. But if it doesn't happen, then my next show will be in New York April next year. And I want my subject of all my painting, well, most of my paintings, it's going to be this period where we are inside the house, where we cannot go out. So it's going to be about the quarantine and just staying inside the house. Well, I know you're a self-contained guy from my experiences with you, that I wonder if we could dig a little deeper and talk about your own state of mind here. Because everybody has had a change in the state of mind. For example, you referred to your, I think you referred to your childhood a little while ago. And I have the same experience. My mind flies in the time of COVID. And I think of things that happened to me years and years ago that pop into my brain in kind of a recollection. And I wonder if you have this kind of experience, Baudelaire and Proust, the French authors and poets, they talk about this, about how they revisit their childhood and how they see things in a completely different and more expansive way while they're alone. I don't think it has affected me in that way. Because I use everything around me as an inspiration. The COVID-19, I just see as another phase of my life. I don't see as any problem or anything like that. I mean, I stay at home pretty much painting all the time. So that hasn't changed anything for me. It's just the subject matter, which I see a little less thing that I used to see before. So now I'm kind of like transforming that into my paintings. But mentally, to me, this is just a phase of the life. And I don't see as anything different. I guess because I come from a society where I've been through a lot as a child that this is not, I don't see as a big problem or anything like that.  Like everybody else. Let's talk about your life as a child and so we can get some context on that. You say you've been through a lot. And I recall that you were originally from Cuba before you immigrated to Hawaii. Can you talk about your life there? Well, definitely. I mean, the life in Cuba is completely different because I mean, it's a different society, different culture.  I mean, the person that you see, you barely have like YTV. We weren't getting good connection on that. We weren't getting good connection on that. Can you start to answer my question again about life in Cuba as a child? Yeah, life in Cuba definitely was completely different because it's a different society. It's a different culture. And being a communist country, I mean, there is a lot of lack of food and other things that we're used here in this country and we give for granted. So just basic stuff, like a lot of the time we didn't have electricity or we didn't have water. And that was just became normal, you know, not having electricity and not having water in the house. That was normal. And not having food was normal. Open in the fridge. And the only thing that you have in your fridge literally was water and ice.  And if you were thirsty, you drink water. You know, there was nothing else in normal.  A lot of the times, then, you know, coming here to the United States and see how wonderful these countries and everything they have to offer, then, you know, when you come into other circumstances, you know, like what we're having now with the COVID-19 and things like that. Yeah, well, it's a difficult time, but still you have a lot of other things that you wouldn't have if you were to be in another country, you know, because having the COVID-19 problem and you would be living like, you know, in another country where you don't have food, you don't have anything else. Then that would be a lot worse. So it's a different perspective for seeing things. Well, you know, it is, but it is a social experience and one of the elements is your contact with other artists. And actually, we have another question I want to post to you that came in on the chat here. So the question is, you know, do you have fellow artists that you compare notes with? And what who are they? What artists do you look up, who look you up by phone or by Zoom?  And what what is the context of your conversation about your respective art? Well, when it comes to art, I study and things like that. I like a lot of the old stuff. I look at a lot of the old masters, but today's day what I do, you know, to keep me motivated and to like keep talking to another artist, I go to the Honolulu Academy of Art, you know, on Wednesdays, they have like a class for like an old class over there. And then I just go over there to share with the other artists, there is another maybe 15, 20 people in the class. That way I go around, I can see everybody's work, I can talk to them about their work, and then they come and talk to me about my work. And that's kind of like a way for me to keep myself motivated and keep talking to another artist and seeing different type of art. So I get an idea from, you know, what they're doing, different subjects, completely different from what I do. And then that also gives me perspective to my work, because I kind of like see and pick from everyone, you know, like I learn from everyone. A lot of the times I talk to these students, which for them, they're kind of like, they think that there's, you know, they're studying and they got nothing to offer, you know, their paintings are, they think very simple. But when I look at those paintings, then I get ideas or stuff that is different perspective from what I see in my paintings. And then I, you know, I learn from them and they don't realize that. But when I talk to them and I kind of see their work, I kind of get a little bit from everybody.  Whatever they're doing, they're looking for a story, an element here and an element there, you know, looking for things that would interest other people. It sounds like the same thing that you're talking about. So, you know, the other thing I wanted to ask you about is, you know, the art world in general, is it, is it changing the art world in general? Do you think that people are having the same experience that you're having other artists? You know, for example, I don't know if you watch television, but whatever media you get, there's, there's all kinds of emotional messages there. And they affect us all.  And I feel we're in a different world now. It's not just another chapter in Darwin Leiva's art. It's everything, everything is different. And as soon as I feel that we recognize that, the better off we'll be in terms of dealing with the reality. Okay, so how do you feel about that? How do you feel about the world? And your feelings about the world, aside from the physical objects, the artistic, the light, the shapes, the form that you see, and that you incorporate in your paintings. What about these times of COVID? What about the masks, and the illnesses, and the death, and the hospital scenes that we see almost every day in the media? Do you incorporate the mood of that, the emotional power of that? Is that, is that happening to you too? Yeah, you know, definitely that's something that have changed the world. And I think this is something that is going to change forever the world. You know, this is one of those events that change history, kind of like 9-11 changed history in the United States. We start doing things differently after that. Then I think this is one of those events in history that is going to change life for everyone.  So definitely the way that we do social life is going to change. The way that we interact with each other is going to change. And that's not something that's going to go away in a month or two. That's something that is going to take some time before people can adjust to that. So and that's affecting the whole world. I mean, that's not something that affects only one person. That's something that is affecting the whole world. But I mean, I think that eventually we will come out of this, you know, like the world have overcome some other problems that we have in the past. I mean, different plays and things like that that we experienced many years ago and, you know, we overcome that. So now, I think we will overcome, but I know it's a hard situation for a lot of people and I know that is, you know, very difficult. Yeah. Well, do you think that the objects reflecting this period of all the, you know, the pain and the trouble of it will find their way into your painting? Will I see face masks in your painting? Yes, yes, you will. That's, you know, and that's one of the series of paintings that I'm doing inside my house. I was kind of like brainstorming, like all the different plays, okay, I will do here one, one in the living room, one in the night room. And then I was thinking, okay, I will do one in the porch. But then I was thinking, well, if I go out to the porch, then I have to use a mask. So, you know, 80 sitting on the porch, we have a mask on it. Or, you know, like every time that I do any painting with the person outside, then it will have to have a mask on it. And that will just represent this period that we are in right now, definitely. That's the role of the artists is to translate the reality in some special way, to interpret the reality for the rest of us. And the reality is changing. And therefore, you know, your view of the world that you're painting, your expression must be changing as well. So how do you see the future for yourself, Derwin?  But how do you see the future evolving in your art and in your life? Well, I think for my art, you know, all these the cancellation of all the shows and things like that, you know, I don't know if it's like kind of like a step back. But I think eventually all those shows are going to happen. So I will have to catch up, you know, this year is going to be a slow, but I think next year probably is going to be a very like fast paced year for me as an artist. And that's what I see, you know, if everything, if we overcome this problem that we have in now, and we in some way go back to what we used to have as a normal life, you know, definitely we're going to have some restriction. But if we overcome that, I think next year is going to be a year where I'm going to have a lot of shows and a lot of opportunities that I'm not going to have this year this year, you know, I guess it's going to be kind of like the stock market, you know, sometimes up, sometimes down, and this is a year that is going to be down for me or for, you know, not for me only for any artist, because I don't think that anybody's doing any show, any exhibition, anything like that. So this is affecting a lot of people, you know, and well, next year will be a good year. So yeah, it's sort of like the economy in general. And I suppose as the economy does better, more people are out there buying art, which is ultimately important to you, because that's what you do. And I would imagine that while the economy is down and out the way it is now, nobody's buying art. Am I right? Or are people knocking on your door these days? Well, no, you know, a lot of the shows that I do kind of ask the venue for me to sell my work. And by not having that, then I will have to shift to online selling. So now actually I'm working with a company from New York, we're setting a new platform to start selling my work through them on the internet. So that's kind of like a work in progress. I'm going to have it set up maybe for next month. And then we'll see how that works. So I was going to be shifting from going in submissions into going online and start selling online. Well, while we've been talking, our engineers have been showing pictures of your art because we have a collection of the pictures of your art. I noticed while I'm watching that you're a very Latin, high vitality, high color style, always includes musical instruments. And so always, well, I shouldn't say always, but most of the time. Can you say why are there musical instruments in your art? And are you continuing to include them? And do you think you will continue to include them? I do always use them because to me, music is very important. I mean, I think music is important to everyone. Everybody listen to different type of music. But when we do listen to music, make us happy. And that's what I want to represent in my paintings. You know, no matter what the situation is, no matter what the subject in my work is, I always want to have that element of happiness in my painting. And that's what I put the musical instrument. In my case, I use musical instruments that are typical from Cuba, you know, a lot of times. But it's just a representation of the music because I know, no matter what kind of music you listen, either if it is classic music or rock or any other type of music between that stream, then you listen to it because it makes you happy, make you feel, you know, different. And because I think it's important to everyone to have that, I always put it into my paintings. And yes, I will continue to put it into all my paintings. I always try to find a way to put it in there, even if it's just, you know, like a small representation of it. But definitely. That's wonderful. Make people happy. What a great thing in life. And it is uplifting. And I'm so glad we had this conversation. And I'm so glad we connected. And I'm so glad to learn more about you as I have in this half hour. So, Dervin, where can I look more for your art? Do you have a website or a place where I can take a look? Yes, definitely. I have my website, which is my name, derwinleiva.com. And then also a lot of my, the things that I do daily, I post it in my Instagram, which is derwin underscore Leiva. And that's normally what I pull, the most updated work. And that's where people can see my work or contact me a lot of the times. I get a lot of contact to the internet. Yeah, Dervin, it's always so refreshing to talk to you. I'm so glad we connected today. And I want to do it again soon. I wish you all the best. I wish you well and stay well. Will you please? Thank you, Dervin Leiva. Thank you for coming. Thank you, Gabe, for inviting me. I know. It's a pleasure being on the show. Aloha.


Carbon nanotubes, CNTs, are nanoscale cylinders of graphene with exceptional properties such as high mechanical strength, high aspect ratio, and large specific surface area. To exploit these properties for membranes, macroscopic structures need to be designed with controlled porosity and pore size. This manuscript reviews recent progress on two such structures. CNT-bucky papers, a nonwoven, paper-like structure of randomly entangled CNTs, and two isoporous CNT membranes, where the hollow CNT interior acts as a membrane pore. The construction of these two types of membranes will be discussed, characterization and permeance results compared, and some promising applications presented. This article was authored by Stephen Gray, Stephen Hawkins, Mikhail Duke, and others.


Welcome to MAV analysis for HEDSHOX. I think it's long overdue that we take a look at hybrid analysis and how to use it for initial MAV assessment. This is the hybrid analysis website and what this is it's just an automated sandbox system so you can drag and drop a file inside it will run the file and it will process the dynamic execution of the file and then create a report for you. So the purpose of this as a MAV analysis at least you can use this for initial analysis. So what does it mean? You will, before you even try to dive into analyzing the code of the MAV or the sample you have in front of you, you should try to find which is the best path to look for the relevant code. So in a lot of cases beginners and MAV analysis will waste a lot of time by just you know they see have a sample they put it into detected easy see it's okay it's x86 assembly code put it into IDA and then they get lost because I don't understand what the code is doing and if this relates to you you might want to check stuff in hybrid analysis first. Why? Because this saves you a lot of time you will find more hints to what you should actually do to find the relevant code and what this file does. So here we are let's if you are a malware hunter if you are a malware hunter this is also very useful you can check the scans that were done lately here in the quick scans and files or URL section and then you see all of the latest scans if you combine a low AV detection rate with a malicious threat level that has been determined by the sandbox you will have a likelihood of finding yet undetected malware so that's quite useful. The malicious threat level is especially interesting because that's where you see some behavior in the sandbox usually if you have nothing here or it sets no threat it's probably because it didn't show anything any behavior it doesn't mean it's clean it just means you couldn't find anything that's suspicious which can happen as well with we am aware sandbox aware malware so just because something is determined by hybrid analysis is malicious or is clean it does not mean that this is truly the case okay so what can you do here so as I said if you check for low AV detection rate and a malicious threat level that's probably interesting for you as a malware hunter you can also search for stuff like you could say keylogger search for keylogger maybe you're interested and seeing what people uploaded as green keylogger so that is already some stuff you could actually use because some people for some reason someone put in a an archive now an archive is not executable so it does not make much sense to put something in a dynamic analysis environment which is not executable so something like an archive makes not much sense because you won't get much out of it the only reason it flexes as malicious is probably because of the entire virus detection rate which is 43% so this is taking into account too yeah but there are some other gems in here you can download them like that's the interesting part you can download those so if you're interested in spoiler Phoenix keylogger or Falcon keylogger correct just download from here and you can analyze it yeah cool so let's take a look at a specific one that was also flagged as a keylogger by the hybrid analysis sandbox so this is the file here it has a very low detection rate 2% on virus total and it's labeled as Trojan keylogger but the shred score they determined is 100 we can see some of the indicators that it takes into account which it thinks is the reason that this is malicious which is here at the top and some general risk assessment where it says okay it has global winners hooks to intercept key strokes and to intercept mouse events but actually if I check a sample that's not the first thing I look at it's like the least interesting thing for me because this is just an summary of what the sandbox things is risky here but I want to determine this myself is this actually risky because it depends on the context so this is not the first thing that is of interest for me at least same of the indicators usually I skip this first and go down that's like a lot of stuff so the first thing I really like to look at is the file details section you have here a button to turn more details on so this these are some hashes so what are they firstly this is the hash that is used by hybrid analysis to identify one sample and differentiate it from other samples that are different so what does it mean if this hash is different hybrid analysis will say it's a different sample why why do I know this because this is part of the URL and if that URL changes you have basically have a different sample same as done by various total so various total determinants is based on this hash because this is a hash function Shara 256 is a cryptographic hash function which means it's collision resistant so if you change one byte in the file it will have a completely different hash and it is very hard to find another file or create another file that has the very same hash value as this one so that is the reason why this is being used for identification otherwise you could just graph files that are different but have the same hash map on the same hash and that will be bad for such a sandbox so these are included and but usually not used that much anymore these were used in the past for the same reason and they are often still mentioned in matter analysis reports so that's why they are here so you can search for them in case you read a matter report and see this is the MD5 for the sample that they used in the report SSD is quite different to the other three hash functions because SSD is a similarity preserving hash and that means if you change just a few bytes in the file this hash value will look almost the same so maybe two characters are different if you change just a few bytes and the rest is the same so this is for finding similar samples and that's also why you can click on it if you click on it you will find samples that look the same and okay let's wait until this is done and it didn't find any so seems to be the only one that looks like this then the impash impash is actually MD5 underneath but this MD5 value is created on the imports of the PE file, PE file imports so imports the ideas that files that behave the same have similar imports or vice versa if you have the same imports that file probably behaves similar so you can find similar files if you click on this so let's see what we find here oh yeah there are some more that are also low in the AV detection rates and considered malicious so this might be interesting impash does not make sense for every PE file so yeah but that's a different topic might come back later. Authentic hash is for the certificate so that's a part of the PE file that is considered relevant for certificate validation but this file is not signed so this isn't that relevant here here it says this is a Delphi executable now remember if you were or let's say most beginner analysts would probably put a sample into detected easy or PE ID see it's a ball and Delphi and then R&R that's hard and then they would try to analyze it in either or any Delphi specific program to analyze it and that's the case where they would get lost they would get lost completely because you will realize so now actually that is not the code we want to look at here why the version info tells us some interesting stuff here and we see a mention of a website flashjessor.com now if you Google flash jessor juggler engine you will find this and it says juggler turns your flash files into standalone programs for it's important for flash development so or here converts SWF files into standalone executables so this is actually a flash application that has been turned converted into an executable using flash jessor so the part that is here detected as ball and Delphi is actually part of flash jessor and it's not so it's the execution environment that's the part that will unpack the actual flash code and execute it so what you want to look at instead in your analysis is the flash code now this version info just so you to put this into perspective the developer of the file and also a matter developer can change the version information so this is something that's completely free for the developer to to put in so this could be fake and this could be something that is just to put us off track so you have to keep this in mind because it's a hint what what this might be where you where you could proceed looking into so it's might be a flash file actually also when I check the version information and the icon that's the icon that's put on the easy file I check it doesn't make sense in the overall picture of the program and in this case when you search for flash jessor you will find that that's no that's not the icon but mini clip com here is mini clip com it's just Google for mini clip com and that is their their logo so this kind of makes sense just inverted but it kind of makes sense that they would have this logo so it seems that this was created probably by mini clip com browser game website so it could be a game and they use flash jessor to convert it what's this here now this is a Portex is my a library that I wrote it's written in Scala and Java I wrote it for my master seizes and they put it the visualization which is just like a side product of my master seizes but they put the visualization part into hybrid analysis which is cool I also think it's very useful because here you can estimate where in the fire are interesting areas and is the fire probably packed so what you can see here is it has a huge overlay that's this blue part here here's the explanation and this one has also in the middle is the entropy the overlay is high in entropy so this is packed area where I assume the fires packed because this is some data that's so high dense in information it it's likely the packed data and the overlay so okay but then if this is a flash converter flash to exe converter it makes sense that it packs other files inside it might just use this overlay to put inside the actual flash executable for instance and flash code that is executed by it so that you know in the whole picture it makes sense here's some more data on the fire sections not much of interest in here except that okay we see code data BSS which is typical for Delphi applications apart from that I don't think there's much that is really interesting for me file imports of course those are the ones used by the impish that I explained earlier so the impish makes stuff on this area and if this area has almost no imports the impish is of no use for you so if there is just one or two don't bother with the impish it will not help screenshots are obviously very interesting in this case because we have a graphical interface this is called space fighter rebellion so it makes sense in you know in context with the file name and it says mini clip comm so we also see the icon here and obviously you can play the game but the sandbox did not play it so we also only see the launch screen so but still so is a game it still could be the case that this is just a lore and that there's some malicious code behind it now let's go back to the beginning you remember this risk assessment here where it says sets global windows hook to intercept keystroves and to intercept mouse events now in light of knowing that this is a game do you think this is still a suspicious thing actually no so a game needs to read keystroves it needs to read mouse events otherwise it cannot be played so yeah this is not really a suspicious indicator actually we should just put this off the list here but still we do not know is it malicious or not so let's let's check the next part here is a one of the most interesting parts as well that is the process section and you can also click on these processes to check more details about them we see here there's a space fighter rebellion.exe process so this was the file originally started by the sandbox and then this one started another process called space fighter exe so that's a different process name the process name is dependent on the file name so it started different file to create this process generally it's suspicious if you see the same one if we see the very same file as the type process it's an indicator that process injection is used it's not the case here that the child process was started so this one again because that's a different one so we don't know if process injection is used could still do process injection it could create a copy of itself with a different name and run this so it could be using process injection now if we look at the beginning here it says writes data to remote process to check if it does that we can click on it get the information about the API calls that have been logged now what's a bummer is we only see the first 1000 calls so we might miss data and when it's not there if it's not there doesn't mean anything so I had made a process injection graphic or also video about typical process injection APIs that you can search for here but yeah if one of the first one I do is write and we see already there's a call to write virtual memory and NTDRL and well that doesn't look much like process injection because it's only 34 bytes that's probably just some arbitrary data not really probably not so in the network analysis area we don't see any requests or any network requests so this is not indicative of a keylogger you remember that we saw this keylogger label where does it come from the keylogger label it comes from virus solo why see this that's where it comes from they just checked if there's any good detection name probably we see there's only six detections for this yeah because we chose specifically file of a low detection rate and that's where the keylogger stuff comes from and also from this one here but so far I don't see reason to assume it's a keylogger because it's a game it needs to log your not log but hook your key keystrokes and we have no network so how is the attacker supposed to get the keystrokes in this case well it's possible that this just did not happen because the maver only does it once a day we don't know maybe it waits for a long time until it's upload some keystrokes that could be possible yeah but so far no indicator for that the extraction strings these are interesting as well if I remember correctly it even includes some in-memory strings so you might find quite interesting stuff you can score through see if you see anything interesting there is also a selection of strings that are deemed interesting by hybrid analysis just goes through see if there's something that looks like it could be typical for malware something that catches my eye is this shall open command it's often used in combination with certain UAC bypass techniques so if I would take note of that and specifically check in the deeper analysis of how this string is used if this is indeed a UAC bypass technique and similar we can see here similar stuff and everything just points to the jester environment so this is probably really just a dot flash converter and nothing else when it comes to the main Delphi code now as I said this part here the process it has to drop the space file somewhere to create a process of a different name so what I'm questioning is is the space fighter file copy or is it the same file a space fighter rebellion.exe and if you check down here you see that's the space fighter exe and it's a different file why do I know that because the hash the shard 256 in different one if you compare this it starts with one five five a and ours you see it in the URLs it's such a zero c4 and so on it's a different file and this file is also deemed clean by virus total it has only zero detection rate of zero let's check the virus total report actually oh and the name is me of this file is as we flsh32exe so this is flash flash executable check it yeah that's a flash player and we see it also named the space fighter.exe but yeah that's just that makes sense you know if you you cannot assume that a computer where the game is being played has flash player on it and to be able to execute this flash application everywhere on Windows systems you just put inside the execution environment which is the flash player inside this whole file additionally with the flash code so now you know it's pretty sure that this is a flash executable just and you only need to check the flash code of that and not the Delphi code this just around the earth deemed malicious for what reason because someone some AV scanners think it's malicious but then the name just around for me just indicates it's part of this gesture execution environment and well when I check virus total roughly three is not much and all of those security vendors are not really well known so these are well if it was like Kaspersky or Avira or Bitdefender I would take it a bit more seriously but no not these that's likely clean and this file at least so and now as a last measure I would probably just check okay what what what do we have here as you know malicious indicators let's go through them a bit and what will also tell you not all of them might display it because you need to for the full version for that so not everyone has the money to do that but let's go through them it says it has five malicious indicators which are probably the responsible for for this verdict and threat score and the first one is Windows hook to intercept mouse events we already know that makes sense for game so ignore that extracts a file that was identified as malicious but that was the gesture on the hour where we checked virus total and it's like nah it's probably clean plus if you check the first submission it 2008 if this was malicious it was scanned one day ago I don't think it takes that many years for Melvier to stay unnoticed so no not really indicative installation persistence computer-based training hook sets a callback procedure using this fellow I'm not sure what this is about I guess I would have to Google what this actually is writes data to a remote process we check that and now since that you open it you see are there has been actually they have been more calls to this right process function I guess but these are all I could I only at most 52 bytes not really that's global in a stock to intercept keystrokes so same it's a game so what do you expect yeah not really none of these are indicative of Melvier in this case so suspicious indicator let's also go over them a bit it says here anti-reverse engineering fires fires unusual entropy sections and this is something you know you can compare with this picture here it says the code section has a lot of high entropy I do not see this here actually because the overlay is way brighter than the code section is let's check the code section the entropy is 6.4 there's a little bit of a mismatch because I calculate the entropy different from from this year it seems that here that seems very high because you know entropy is either based on 8 bits so it goes from 0 to 8 or it is from 0 to 10 and it seems that here they calculate the entropy from 0 to 10 whereas down below it's created from 0 to 8 so we have a small entropy here in this area they do that's bad they use different pauses it's that's not this one that's a bit confusing but generally this value is high it means it's actually probably packed but then it's not that high the overlay is far higher we can see in the picture it unfortunately the overlay entropy is not shown here okay anyways it's not as high as it seems here environment awareness tries to evade analysis by sleeping many times it's probably normal for for game to do that I'm not sure reads the active computer game name yeah okay if it's just that why not sample was identified as malicious by at least one virus engine we know that already reads configuration files now it reads its own its own any file so yeah that's the fire drops itself it's its own settings are nothing suspicious here drops executable files every know that already but then that's like the flash executable that needs to run the flash code write the fire header to this that's when it writes the space fighter easy then yeah so it's not another indicator it's just logical if you drop an executable file you have to write it yeah found potential IP addresses I think that's the version number from the version information here five version product version it's not an IP address reads terminal service related keys oh I would have to Google those a terminal server okay GP related I don't know but it did not do any network connections whatsoever not sure why it needs that max files for deletion yeah apparently this is dropped in temp like this is common for such wrapper files that they drop the execution and settings and the code execution environment into the temp folder and delete it afterwards that's what the temp folder is for so you can just put temporary files in there nothing suspicious about that opens fire with deletion access rights yes that's the same as this one max file for division then you would want to open it with deletion access rights entry point isn't an uncommon section now this just around here seems to be packed with AS pack we see this here as well they are crowdsourced Yara rules matching on AS pack and they find the section name named AS pack and you check the sections of this one it has an AS pack section so that's the reason why it's probably packed and import suspicious API's well this is to deal with regulatory stuff I attribute all in all I don't think this combination is suspicious I mean yeah but what you can use this for is if you want if you did not have a flash file and did not have to analyze the flash code but the actual assembly code and Ida I would check specifically where those API's are used because yeah they are interesting if you analyze malware but it doesn't mean that the files are suspicious because many files need those API's as well that are clean and well why not installs patches hooks running in the running process this might have to do with the hooks that it places for keyboards and for keystrokes and mouse events reads information about supported languages whether probably every file does this I'm not sure why this is suspicious lot of fights do this and then it has some more indicators it doesn't tell us because we don't have the full version yeah but I don't think you are missing out on much if you don't see them as you can see most of these things that are deemed as suspicious are actually not that much of a deal here so I found a URL flash just a calm yeah they are more informative files things here but I think you get the get the idea of how to use this properly and what you would do next so next thing for you is Google how you analyze slash files and there you go so to sum this up what did we learn today what can we conclude well is our sample clean or is it malicious well the likelihood that this file is clean is very high but we do not know for sure to know this for sure we will have to analyze it further now hybrid analysis in this case helped us to determine where we should need to look further we know already that the sample is dropping a flash player and probably executing some flash code so that's where we should look next in case to be more sure about its cleanness determining if a file is clean is actually more difficult than determining if a file is malicious simply because if it's malicious you just find a malicious code that's it if it's clean when do you stop searching for the malicious code that still could be there that's harder so at some point you will have to decide if it's worth to continue or not yeah but in this case I would probably just analyze the flash code and then that's it so I would declare it clean if I don't find anything suspicious in there what did we learn about hybrid analysis now hybrid analysis very useful obviously to save us time in the long run you should take the time and use these tools that give you an overview that includes using hex editor using a file static file parser like PE parser using tools like detected easy and that includes sandbox systems so those are the first things to check and to take notes and a lot of my analysis is you make assumptions and then you try to confirm these assumptions now a lot of the things we find oh it's probably flash those are like probabilities it could be as we learned the version info could have been faked by the malware actor threat actor and then it might have been seen like this was a flash application when it's actually not so you need to always confirm your assumptions and come up with new assumptions if they don't confirm yeah and sandbox systems in general although they are useful you should not take their overall result as the global truth they have wrong verdicts all the time and you are the expert or the matter in this US the matter in this you're the one who needs to interpret all of the data and the results in this sandbox report should not be on the sandbox system to tell you what is actually suspicious you need to use your own knowledge and common sense to check if this is true so I hope you learned something today if you want me to check out the samples in various total hybrid analysis whatever and run through them let me know if it's interesting for video I will include so but I don't promise anything so no I'm not publishing that often so I usually choose very carefully what topics I will cover yeah but let's hope the next one will be soon and see you next time


We're going to give you a fine of a thousand euros Thousand euros for with nothing in it Shit was that to get you off the e-mail.    Yeah Respecting a baby Everything was going cool and it's good good Suddenly the hospital Her contractions were happening, right? Okay. Her contractions were going down and We were told to phone the hospital so I phone the hospital. I said there, right, okay Her contractions at this level and do it. No, it's not close enough.     I mean pain. I mean pain. It's hurting. It's hurting Yeah, she's over over over nine months gone. No, yeah, and uh So I'm right.  So anyway drove at the hospital. Yeah drove the hospital Sunland QE No, not QE.   Anyway went there turned up and they went No turning away because we only have one member of staff on night. All right. Okay, right So we left went back home My wife's in pain.  Yeah So phone back up. Yeah, listen to me. We need to come back.  Yeah, just do something about it They went no No, we can't yeah, right. Okay.  Yeah, she's saying take me to hospital.     Yeah, they checked her out. Okay. They checked her out Baby you died by this time right baby you died Can you sit here?  I knew the baby was dead. I knew my wife was going It's a baby alive alone. Yeah, I knew it's dead.  There was no heartbeat blah blah blah Can you I could tell by the faces.


But I like this image because the people who are engaging with this image and the websites that we're posting it, Instagram accounts, X, Y and Z, that we're kind of propagating it. They're mostly ones that were about sneaker culture and, you know, rap and hip-hop. And these are exactly the kind of people that I actually want to reach with my work because there are people who have all the capabilities to be informed about the invasion of Ukraine but are probably choosing not to. And if I can say something about fashion in the context of conflict, it can be a vehicle, a sort of Trojan horse to create greater awareness and conversations with people who otherwise would choose not to be aware.


Okay Hello, everybody. How's it going? My name is Martin. I work at open Zeppelin Until they were going to be talking about that construction and why It's probably the future of crypto UX and probably security too. Let's begin So let's first define what a kind of traction is and to better understand this. It's very to speak about Smart accounts you might be familiar with them already Smart accounts are basically smart contracts that behave as accounts. They verify transactions They hold assets privileges roles like owner They can also call other contacts, which is very important some known examples of this is a very popular knows is safe a multi-seg Arjun wallet that has social recovery and instant up Now a kind of fraction is basically a smart account can also pay for its own transactions. That's pretty much it What can we do with them wall basically we can have custom validation Skins this means you can use a theory and signatures become signatures water signature You want multi-signature or any other criteria or logic you want to implement? For example, this is only valid on Wednesdays You're going to implement key rotation in case picture the scenario in which you lose your you compromise your keys Instead of migrating all of your assets and roles and whatnot. You simply rotate the keys and you're done You are safe We also have wordians social gory, which is a very good feature and session keys. I think of session keys as basically For example a JSON web token or a set of preview of permissions you grant for example a website a web application So you sign once a set of permissions defined by some policy or something and then that website that can can Act on your behalf without you having to sign each transaction every time which basically gives us web 2 experience on web 3 So how does it look today on start net? This is basically the Interface of an account we are going to focus on the last four ones which are execute validate validate declare and validate deploy We can think of this in a two-step execution flow first the validate step the validate step You can define arbitrary logic to determine whether a transaction is valid or not There's There's a few Limits in here. For example, you cannot read all our contracts storage. This is to prevent spam pictures scenario in which There's many transactions that depend on the storage of another contract that contract changes that storage And then invalid lots of transactions that could be a spam. So that's a prohibited So these valid function is used by sequencers to know in advance whether a transaction is valid or not because Instead of a new way in which you can only you simply verify the signature You can only you cannot do that as simply in here because you need to execute some code and this execute step That's what you would expect Finally since Counts are contracts you need to deploy them and you need to pay for deployments. So how do you do this? Well, basically we can do counterfactual deployments, which is you calculate the address of your contract before you send funds to that address that has no contract yet Then there's this validate deploy function that the protocol uses to validate whether the funds on this address can be used To pay for this transaction or not and then basically you deploy your smart account. Well account of traction and Finally in starting it you can use opensable in contracts for Cairo in which we have an account a regular account, which uses this target Signature scheme we have an ith account, which is a term signatures and an account library that you can use to build your own custom accounts and I hope that by now you you got the idea that it means a huge improvement in onboarding user experience and security Martin that was fast. Oh, sorry one last thing. There's a pop for this talk Yeah, you can just ask me right now. Oh, I mean since this was the last talk You have the chance to get some questions from the audience. Of course, we still have time So in the ethereum version of account abstraction, you will have a separate mempo and the boundaries and stuff so I guess in Stock net this role will be replaced by the sequencer itself Good. I didn't get the last part. Oh So like in the so in ethereum led in order to execute account abstraction in the separate mempo and a boundary system So what would be the equivalent for stock net, right? So, I mean you mean EAP 4337. That's right, right, and you're asking about the paymasters No, we're talking about how like is there an alternative mempo that actually relays like better transactions or how does it happen concretely on stock net? The use of account abstraction So basically you send a transaction and the sequencer picks that transaction validates this valid function If it's okay, then it's inserted into the block. I'm not sure I got the question, right? So account abstraction is actually built in right? Sorry. Oh, that was it. Yes. There's native account abstraction on the system There's no we always so they're completely replaced by them How do you ensure that in the validation process the validation result will be the same in the actual execution? Well, what do you mean for example, for example, if one transaction depends on the block timestamp You okay? Sorry. Yeah, so that's part of the limitations. So you cannot read any external Information from the contract that includes like blocks timestamp other contract storage So you're gonna use anything that depends on anything else that the very same contract So that I mean that every wallet address on stock net cannot use those functions No, no, they can but not on the validate step They can on the execution step, but the valuation step has these constraints to prevent spam. Got it. Thanks Thanks for the great talk and one question Could you and you just have a lot of execution code in the validate step and only at the end find out that it's not Valued it not not a valid transaction and thereby spam those Notes infinitely definitely So but there's a smaller chances So you for some other reasons the so you could you're saying that you could invalidate the transaction on the executions Part not the valuation No, I mean in the validate function put a lot of stuff in there complex stuff like it takes a long time to compute only in the end There's a gas limit. Okay. How much is the gas limit for the validate function? I gotta know, okay, but that's okay That's the solution. Yeah All right. Thank you so much. This was the end of day one. Thank you