Tagged Questions

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

learn more… | top users | synonyms

-6
votes
1answer
34 views

yara signatures for detect and identify anti virus [on hold]

my name is reza kazemi. I doing a research about anti virus. therefore I need a database of yara signatures for detect and identify anti virus. please document, file or an example of code written Yara ...
0
votes
1answer
96 views

Unable to dump malware assembly using objdump

I'm trying to dump assembly code of a ShellShock malware explained in this blog post: MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... . After dumping using objdump ...
-2
votes
0answers
97 views

Why can't i open an .exe file that contains a virus in IDA, when my antivirus software is running?

I have downloaded a sample of Conficker, W32/Conficker.A I guess, to analyze it and compare my own results with some professional analysis papers. So, the first thing what I do was to unpack it using ...
1
vote
1answer
134 views

Question about process injection

During an analysis, I found the following piece of malware: ... lea eax, [ebp+ThreadId] push eax ;lpThreadId push ebx ;dwCreationFlags push ...
3
votes
2answers
140 views

Decompiling .NET marshaled code

There's a .NET malware sample I'm trying to analyze, which goes more or less like this: internal static class Class1 { public static byte[] Code = new byte[] { 9, 249, ...
1
vote
1answer
91 views

Tracing adware on windows - ads showing up in browser

Sometime ago I came across this situation: Windows 7 machine infected with adware, ads tabs opening up in chrome out of nowhere. Pretty invasive stuff. In the end i got rid of it with some malware ...
0
votes
1answer
82 views

What is the relation between binary (executable) instructions and execution instruction [closed]

What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ? In other world, in area of malware analysis a binary ...
2
votes
3answers
239 views

Detecting packed 64-bit Windows Portable Executable (EXE) files

What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files). I am not interested in the packer used I would just like to know if the file is packed or ...
2
votes
1answer
185 views

Computer Malware: More complex than metamorphic?

I have read the topic on oligo-, poly- and metamorphic malware. I have done a quick google search, and it seems like the concept of metamorphic malware was already known in the DOS age and in the ...
2
votes
4answers
148 views

Search remote malware zoo for homologous samples

I've got the following problem: I'd like to find new binaries of a certain malware family -- unpacked -- for subsequent analysis (active C&C comms analysis). Is there a database of binaries ...
0
votes
0answers
128 views

Is there any technique called “DLL Replacement”?

I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) ...
-2
votes
1answer
126 views

How does this test for debugger [closed]

While reading a book it mentioned that the following code is usually used to as an antidebugger mov eax, large fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] retn I don't ...
1
vote
3answers
327 views

How to figure out which imported function(s) in a virus determine its behaviour?

I want to know how to find the functions which is interesting in malware tools. For example, I have a sample of unknown virus (this sample is lab01-01.exe in the book practical malware analysis ...
-5
votes
2answers
195 views

Anti-debug techniques for MS-Windows?

Is there any anti-debugger tricks used by malware other than interrupt INT 0x2D ? And, how do they work ? Working examples would be really nice !
2
votes
1answer
93 views

Is data exfiltration possible without obvious system calls? [closed]

http://resources.infosecinstitute.com/data-exfiltration-techniques/ I am teaching myself to identify exfiltration of sensitive data with malicious binaries. One thing I have noticed, is in most ...
1
vote
1answer
128 views

How to change PE signature? [closed]

I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool ...
-1
votes
1answer
68 views

How to decide file is malware or not? [closed]

How should I decide file is malware or not. Before reverse engineering any file, I should be suspect the file. What are the various ways to decide if exe is malicious? Thanks
1
vote
0answers
54 views

Malware terminated in Ollydbg after a while - Why? [closed]

I try to analyze a backdoor program with ollydbg. When I go through the assembly code by clicking the "Step Over"-Button, i stop sometimes to make a notice on a paper. Later when i want to go trough ...
6
votes
2answers
321 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format ...
2
votes
1answer
357 views

Alternative to CaptureBAT on Windows 7?

I am working on some malware that currently only runs with Windows 7 is detected. I would like to use CaptureBAT, but it doesn't work on Windows 7 (with the exception of network monitoring). Is there ...
1
vote
1answer
150 views

Are jump instructions targeting addresses in ntdll a sign of malware?

For fun I downloaded an installer from a "driver downloads" website. I do NOT intend on installing it, but I was interested to check it out just to see what it looked like. I tossed it into Ollydbg ...
4
votes
2answers
170 views

How can we determine that malware are related?

I am curious to know about how researchers can know when different malware are related. for example: Stuxnet, Flame or Duqu, are told to be written by the same group. Does anyone know how they figure ...
4
votes
3answers
332 views

How to break on not-yet-loaded kernel driver

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
-3
votes
1answer
201 views

How do anti-virus programs catch a virus? How they detect it? [closed]

I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?
4
votes
2answers
436 views

how to reverse DeviceIoControl?

I have started reversing this piece of malware. At some point it creates a service and starts it, then immediately it calls the function DeviceIoControl and the malware went from "paused" to "running" ...
3
votes
1answer
208 views

Trouble analyzing a ransomware

I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps : When loaded in Ollydbg it pauses at: 00401000 > $ 8D9404 ...
6
votes
4answers
387 views

How antiviruses name malwares

While analyzing a binary online through the virustotal service , I found out that different AVs named the binaries differently.For instance, for that same binary Norman named it Obfuscated_A, ...
-2
votes
4answers
882 views

Does learning Metasploit help me in reverse engineering and malware analysis?

I learned basis of assembly language with, both, AT&T and Intel style. After that I gone through buffer overflow and how to use shellcode with it. Should I go for Metasploit now?
1
vote
1answer
315 views

How to dump a DLL not listed using Process Explore and similar tools

I am trying to reverse engineer a DLL that may contain malware. One thing I noticed is that it hides itself from the DLL LDR_MODULE list. So, when I use Ollydbg or smiler tools I do not see it and ...
3
votes
1answer
106 views

IDA debugging API's security

I recently saw funcap, a plugin that captures function calls made by a binary using IDA's debugging API. I have setup IDA on my host machine. My VMs aren't fast enough to run IDA in them. How do you ...
3
votes
3answers
609 views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
1
vote
3answers
454 views

Malicious word document shellcode extraction

I am playing with some malicious MS Word documents which exploit a vulnerability in Word 2k3/2k7 to launch the shellcode. I am able to run it dynamically and get the drop-bys. However, I am interested ...
2
votes
1answer
189 views

What Honeypots are recommended to capture malwares (for analysis)? [closed]

I want to operate honeypots for malware analysis purpose and packet capture. What honeypots are recommended for beginners ? And, what is the best to set-up an honeypot, should it be in a real machine ...
2
votes
1answer
176 views

Detailed description of malware content [closed]

I have just started my journey into the vast and intersting field of malware analysis. I would like to know if there is any website/book or another resource that explains what a particular block of ...
2
votes
1answer
438 views

Intro to reverse engineering [closed]

I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in ...
10
votes
3answers
2k views

Which IDA Pro Signature should be used for Borland Delphi 6.0-7.0 binaries as reported in PEiD?

I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using ...
7
votes
3answers
552 views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
2
votes
1answer
172 views

Decoding Malware javascript [closed]

My .php and .js files have been attacked twice in a month with some JavaScript code. After going through this similar thread, I ran the JavaScript code posted there and found this decoding result. ...
1
vote
1answer
303 views

Find out decrypted body of Polymorphic malware

I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its ...
3
votes
2answers
1k views

How to unpack files packed with multiple packers?

As I am just getting started in RE, I've mostly faced files packed with a single-layer of packing , such as UPX, ASPack, etc. Unpacking these protections is fully documented online. The problem ...
7
votes
5answers
632 views

Malware in virtual machines

Once I perform static analysis on a malware sample, I next run it in a virtual machine. Does this give the malware a chance to spread to the real machine? Does this give the malware a chance to ...
-1
votes
1answer
226 views

What should I look for when building a malware lab on a budget? [closed]

What should I look for when building a malware lab on a budget? $800 USD or less. I'm talking about hardware and virtualization capabilities, or alternatives (e.g. FOG Server). Not user programs ...
8
votes
3answers
570 views

How to get virus body of Polymorphic Malware

I want to decrypt polymorphic malware and want to get actual virus body which is going to do infection. I tried to decrypt virut.ce (this is one polymorphic malware) in ollyDbg but it is using anti ...
5
votes
3answers
472 views

What is this obfuscation method called?

I have recently seen the following code obfuscation method: ... jump loc_1234 ;------------------------- Bunch of junk ;------------------------- loc_1234: code continued... The logic ...
3
votes
3answers
205 views

Tool for checking if there is any patch in the loaded module

I'm looking for a tool that is able to check loaded module for any placed patches even on not exported functions. I'm aware of Gmer, RKU and Co. and frankly I don't really trust their results.
4
votes
1answer
258 views

Prevent malware from deleting itself during installation on Windows x64

Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection. I've looked at CaptureBat, but its ...
4
votes
1answer
315 views

How to handle exceptions in a debugger when reversing malware?

I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When ...
1
vote
2answers
256 views

How to get all the references to function using PyDBG?

I'd like to get all the addresses in the binary that some function is called from using PyDbg. The address of the function will be supplied as a parameter. Do I have actually to scan all the code, ...
12
votes
3answers
1k views

How do AV vendors create signatures for polymorphic viruses?

I was working on a hobby AV project using ClamAV's engine. While ClamAV is a good open source engine, it has poor support for detecting polymorphic viruses. The latest updated version failed to detect ...
2
votes
0answers
38 views

How to add xrefs to indirect call targets in IDA? [duplicate]

I was analyzing win32.ramnit's dropper for fun. Almost all the calls it uses are indirect calls. I have figured out the destination addresses using manual analysis. But how can I add this information ...