typo fixes

anti-behavioral-analysis/detect-debugger.md

@@ -21,7 +21,7 @@ Methods
 * **Stack Canary**: Similar to the anti-exploitation method of the same name, malware may try to detect mucking with values on the stack.
 * **TIB Aware**: Accessing thread information (e.g., fs:[20h]) for debug detection or process obfuscation.
 * **RtlAdjustPrivilege**: Calling RtlAdjustPrivilege to either prevent a debugger from attaching or to detect if a debugger is attached.
-* **Interrupt 2D**: If int 0x2d is mishandled by the debugger, it can cause a single-byte instrustion to be inadvertently skipped, which can be detected by the malware.
+* **Interrupt 2D**: If int 0x2d is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by the malware.
 
 Malware Examples
 ----------------

anti-behavioral-analysis/evade-memory-dump.md

@@ -17,7 +17,7 @@ Methods
 * **Tampering**: Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).
 * **Guard Pages**: Encrypt blocks of code individually and decrypt temporarily only upon execution.
 * **On-the-Fly APIs**: Resolve API addresses before each use to prevent complete dumping.
-* **Feed Misinformation**: API behavior can be altered to prevent prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/hooking.md).
+* **Feed Misinformation**: API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/hooking.md).
 * **Flow Opcode Obstruction**: flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4)
 
 Malware Examples

anti-static-analysis/exe-code-compression.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0036**|
-|**Objective(s)**|[Anti-Behaviorial Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Software Packing](https://attack.mitre.org/techniques/T1045/)|
 
 Executable Code Compression

anti-static-analysis/exe-code-optimize.md

@@ -12,7 +12,7 @@ Code is optimized, making it harder to statically analyze.
 Methods
 -------
 * **Jump/Call Absolute Address**: Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.
-* **Minification**: Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.
+* **Minification**: Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.
    
 Malware Examples
 ----------------

collection/man-in-browser.md

@@ -6,6 +6,6 @@
 
 Man in the Browser
 ==================
-Malware leverages vulnerabilities and functionality in browser softwarwe to change content, modify behavior, and intercept information.
+Malware leverages vulnerabilities and functionality in browser software to change content, modify behavior, and intercept information.
 
 **See ATT&CK:** [**Man in the Browser**](https://attack.mitre.org/techniques/T1185/).

defense-evasion/component-hijack.md

@@ -2,11 +2,11 @@
 |---------|------------------------|
 |**ID**|**T1122**|
 |**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
-|**Related ATT&CK Technique(s)**|[Componpent Object Model Hijacking](https://attack.mitre.org/techniques/T1122)|
+|**Related ATT&CK Technique(s)**|[Component Object Model Hijacking](https://attack.mitre.org/techniques/T1122)|
 
 
-Componpent Object Model Hijacking
+Component Object Model Hijacking
 =================================
 Malware hijacks a component object model (COM) object to execute itself or other malicious code. 
 
-See ATT&CK: [**Componpent Object Model Hijacking**](https://attack.mitre.org/techniques/T1122).
+See ATT&CK: [**Component Object Model Hijacking**](https://attack.mitre.org/techniques/T1122).

persistence/system-firmware.md

@@ -6,6 +6,6 @@
 
 System Firmware
 ===============
-Malware may overwrite the the system firmware with malicious firmware that is difficult to detect and/or enables persistence. 
+Malware may overwrite the system firmware with malicious firmware that is difficult to detect and/or enables persistence. 
 
 see ATT&CK: [**System Firmware**](https://attack.mitre.org/techniques/T1019/).

xample-malware/kovter.md

@@ -14,7 +14,7 @@ Behaviors
 ---------
 |Name|Use|
 |---------------------|-------------------------------------------------------|
-|[Alternative Installation Location](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion/alter-install-location.md) | tores malware files in the Registry instead of the hard drive. [[1]](#1)|
+|[Alternative Installation Location](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion/alter-install-location.md) | Stores malware files in the Registry instead of the hard drive. [[1]](#1)|
 |[Generate Fraudulent Advertising Revenue](https://github.com/MBCProject/mbc-markdown/tree/master/impact/generate-fraud-rev.md) | Performs click-fraud. [[1]](#1)|
 
 References