Analysis. Simulation.
Defense.
PalaviTech delivers clarity and resilience in an increasingly hostile digital world. From malware analysis to adversary simulation and defensive tooling — expertise you can count on.
Our Services & Products
BytesCop
Open-source, on-premise security findings vault. Consolidate pen tests, vulnerability scans, and assessments into a single source of truth.
- Centralize findings across engagements
- Risk-based prioritization
- Actionable insights & trend analysis
Malware Analysis
Identify and dissect malicious software to defend your organization. We expose how threats operate and deliver clear indicators of compromise.
- Static & dynamic analysis
- Behavioral pattern identification
- Reverse engineering & attribution
Adversary Simulation
Controlled payloads and simulation tools that mirror advanced threat actors, giving defenders a chance to test detection, response, and containment.
- Realistic threat emulation
- Attack scenario crafting
- Detection & containment testing
Phishing Simulation
Controlled phishing campaigns to measure how employees respond to real-world lures before attackers do. Safe, authorized, and backed by analytics.
- Realistic email & SMS lures
- Click & credential tracking
- Awareness reporting & training
Malware Packing 101: How Packers Hide Malware in Plain Sight
How malware authors use packers to compress payloads into innocent-looking stubs that unpack and execute entirely in memory — PE overlay abuse, LZNT1 compression, manual PE mapping, import resolution, and social engineering tricks like extension mangling and decoy images.
Latest research & field notes
Windows DLL Linking: Load-Time vs. Runtime and What the IAT Reveals
Build a DLL and two programs that call it — one via load-time linking, one via runtime linking — then inspect the PE import tables to see why malware prefers one over the other. No Visual Studio IDE required.
Malware Packing 101: How Packers Hide Malware in Plain Sight
How malware authors use packers to compress payloads into innocent-looking stubs that unpack and execute entirely in memory — PE overlay abuse, LZNT1 compression, manual PE mapping, import resolution, and social engineering tricks like extension mangling and decoy images.
Remote Thread Injection: Understanding the Tradecraft (Part 1)
How remote thread injection works at each stage — process handle acquisition, memory preparation, and execution triggers — the Windows APIs involved, why attackers make specific design choices, and where the technique leaves forensic artifacts.