Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

learn more… | top users | synonyms

1
vote
2answers
161 views

Detecting packed 64-bit Windows Portable Executable (EXE) files

What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files). I am not interested in the packer used I would just like to know if the file is packed or ...
2
votes
1answer
163 views

Computer Malware: More complex than metamorphic?

I have read the topic on oligo-, poly- and metamorphic malware. I have done a quick google search, and it seems like the concept of metamorphic malware was already known in the DOS age and in the ...
2
votes
3answers
96 views

Search remote malware zoo for homologous samples

I've got the following problem: I'd like to find new binaries of a certain malware family -- unpacked -- for subsequent analysis (active C&C comms analysis). Is there a database of binaries ...
0
votes
0answers
119 views

Is there any technique called “DLL Replacement”?

I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) ...
-2
votes
1answer
122 views

How does this test for debugger [closed]

While reading a book it mentioned that the following code is usually used to as an antidebugger mov eax, large fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] retn I don't ...
1
vote
3answers
298 views

How to figure out which imported function(s) in a virus determine its behaviour?

I want to know how to find the functions which is interesting in malware tools. For example, I have a sample of unknown virus (this sample is lab01-01.exe in the book practical malware analysis ...
-5
votes
2answers
126 views

Anti-debug techniques for MS-Windows?

Is there any anti-debugger tricks used by malware other than interrupt INT 0x2D ? And, how do they work ? Working examples would be really nice !
2
votes
1answer
90 views

Is data exfiltration possible without obvious system calls? [closed]

http://resources.infosecinstitute.com/data-exfiltration-techniques/ I am teaching myself to identify exfiltration of sensitive data with malicious binaries. One thing I have noticed, is in most ...
1
vote
1answer
122 views

How to change PE signature? [closed]

I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool ...
-1
votes
1answer
68 views

How to decide file is malware or not? [closed]

How should I decide file is malware or not. Before reverse engineering any file, I should be suspect the file. What are the various ways to decide if exe is malicious? Thanks
1
vote
0answers
41 views

Malware terminated in Ollydbg after a while - Why? [closed]

I try to analyze a backdoor program with ollydbg. When I go through the assembly code by clicking the "Step Over"-Button, i stop sometimes to make a notice on a paper. Later when i want to go trough ...
6
votes
2answers
309 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format ...
2
votes
1answer
262 views

Alternative to CaptureBAT on Windows 7?

I am working on some malware that currently only runs with Windows 7 is detected. I would like to use CaptureBAT, but it doesn't work on Windows 7 (with the exception of network monitoring). Is there ...
1
vote
1answer
136 views

Are jump instructions targeting addresses in ntdll a sign of malware?

For fun I downloaded an installer from a "driver downloads" website. I do NOT intend on installing it, but I was interested to check it out just to see what it looked like. I tossed it into Ollydbg ...
4
votes
2answers
162 views

How can we determine that malware are related?

I am curious to know about how researchers can know when different malware are related. for example: Stuxnet, Flame or Duqu, are told to be written by the same group. Does anyone know how they figure ...
4
votes
3answers
279 views

How to break on not-yet-loaded kernel driver

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
-3
votes
1answer
183 views

How do anti-virus programs catch a virus? How they detect it? [closed]

I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?
4
votes
2answers
371 views

how to reverse DeviceIoControl?

I have started reversing this piece of malware. At some point it creates a service and starts it, then immediately it calls the function DeviceIoControl and the malware went from "paused" to "running" ...
3
votes
1answer
197 views

Trouble analyzing a ransomware

I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps : When loaded in Ollydbg it pauses at: 00401000 > $ 8D9404 ...
6
votes
4answers
372 views

How antiviruses name malwares

While analyzing a binary online through the virustotal service , I found out that different AVs named the binaries differently.For instance, for that same binary Norman named it Obfuscated_A, ...
-2
votes
4answers
859 views

Does learning Metasploit help me in reverse engineering and malware analysis?

I learned basis of assembly language with, both, AT&T and Intel style. After that I gone through buffer overflow and how to use shellcode with it. Should I go for Metasploit now?
1
vote
1answer
284 views

How to dump a DLL not listed using Process Explore and similar tools

I am trying to reverse engineer a DLL that may contain malware. One thing I noticed is that it hides itself from the DLL LDR_MODULE list. So, when I use Ollydbg or smiler tools I do not see it and ...
3
votes
1answer
106 views

IDA debugging API's security

I recently saw funcap, a plugin that captures function calls made by a binary using IDA's debugging API. I have setup IDA on my host machine. My VMs aren't fast enough to run IDA in them. How do you ...
3
votes
3answers
547 views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
1
vote
3answers
420 views

Malicious word document shellcode extraction

I am playing with some malicious MS Word documents which exploit a vulnerability in Word 2k3/2k7 to launch the shellcode. I am able to run it dynamically and get the drop-bys. However, I am interested ...
2
votes
1answer
186 views

What Honeypots are recommended to capture malwares (for analysis)? [closed]

I want to operate honeypots for malware analysis purpose and packet capture. What honeypots are recommended for beginners ? And, what is the best to set-up an honeypot, should it be in a real machine ...
2
votes
1answer
174 views

Detailed description of malware content [closed]

I have just started my journey into the vast and intersting field of malware analysis. I would like to know if there is any website/book or another resource that explains what a particular block of ...
2
votes
1answer
419 views

Intro to reverse engineering [closed]

I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in ...
10
votes
3answers
1k views

Which IDA Pro Signature should be used for Borland Delphi 6.0-7.0 binaries as reported in PEiD?

I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using ...
7
votes
3answers
519 views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
2
votes
1answer
167 views

Decoding Malware javascript [closed]

My .php and .js files have been attacked twice in a month with some JavaScript code. After going through this similar thread, I ran the JavaScript code posted there and found this decoding result. ...
1
vote
1answer
289 views

Find out decrypted body of Polymorphic malware

I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its ...
3
votes
2answers
915 views

How to unpack files packed with multiple packers?

As I am just getting started in RE, I've mostly faced files packed with a single-layer of packing , such as UPX, ASPack, etc. Unpacking these protections is fully documented online. The problem ...
7
votes
5answers
602 views

Malware in virtual machines

Once I perform static analysis on a malware sample, I next run it in a virtual machine. Does this give the malware a chance to spread to the real machine? Does this give the malware a chance to ...
-1
votes
1answer
220 views

What should I look for when building a malware lab on a budget? [closed]

What should I look for when building a malware lab on a budget? $800 USD or less. I'm talking about hardware and virtualization capabilities, or alternatives (e.g. FOG Server). Not user programs ...
8
votes
3answers
545 views

How to get virus body of Polymorphic Malware

I want to decrypt polymorphic malware and want to get actual virus body which is going to do infection. I tried to decrypt virut.ce (this is one polymorphic malware) in ollyDbg but it is using anti ...
5
votes
3answers
456 views

What is this obfuscation method called?

I have recently seen the following code obfuscation method: ... jump loc_1234 ;------------------------- Bunch of junk ;------------------------- loc_1234: code continued... The logic ...
3
votes
3answers
200 views

Tool for checking if there is any patch in the loaded module

I'm looking for a tool that is able to check loaded module for any placed patches even on not exported functions. I'm aware of Gmer, RKU and Co. and frankly I don't really trust their results.
4
votes
1answer
229 views

Prevent malware from deleting itself during installation on Windows x64

Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection. I've looked at CaptureBat, but its ...
4
votes
1answer
269 views

How to handle exceptions in a debugger when reversing malware?

I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When ...
1
vote
2answers
242 views

How to get all the references to function using PyDBG?

I'd like to get all the addresses in the binary that some function is called from using PyDbg. The address of the function will be supplied as a parameter. Do I have actually to scan all the code, ...
12
votes
3answers
1k views

How do AV vendors create signatures for polymorphic viruses?

I was working on a hobby AV project using ClamAV's engine. While ClamAV is a good open source engine, it has poor support for detecting polymorphic viruses. The latest updated version failed to detect ...
2
votes
0answers
38 views

How to add xrefs to indirect call targets in IDA? [duplicate]

I was analyzing win32.ramnit's dropper for fun. Almost all the calls it uses are indirect calls. I have figured out the destination addresses using manual analysis. But how can I add this information ...
3
votes
2answers
644 views

How to load a dumped process and several accompanied memory pages in IDA?

I have dumped process and several dumped pages of memory that were allocated in it. How can I load everything in IDA into one DB and reference pages in the loaded process?
6
votes
4answers
410 views

Program with no dependencies

while reading the answers to Can I statically link (not import) the Windows system DLLs? I came up with another question. So: Is there a way to write a program that has no dependencies (nothing is ...
2
votes
0answers
72 views

Opinions and suggestions regarding malware sandboxes [closed]

I'm relatively new in the field of automatic malware analysis and I'd like to ask about hands-on opinions about sandboxes in the following aspects: extensibility of the product - adding your own ...
7
votes
2answers
3k views

Difference between DllMain and DllEntryPoint

I have a piece a malware I was share with. (I do this for fun, anyways) Is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the ...
2
votes
0answers
164 views

MITRE MAEC (Malware Attribute Enumeration and Characterization) opinions and usage [closed]

I was looking at some MITRE projects and was wondering what you thought about, and if anyone was using or contributing to, the MITRE Malware Attribute Enumeration and Characterization project: ...
12
votes
4answers
1k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
5
votes
1answer
173 views

Strange GDB behavior in OSX

I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...