Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

learn more… | top users | synonyms

-5
votes
2answers
66 views

Anti-debug techniques for MS-Windows?

Is there any anti-debugger tricks used by malware other that interrupt INT 0X2D ? And, how do they work ? Working examples would be really nice !
2
votes
1answer
81 views

Is data exfiltration possible without obvious system calls? [closed]

http://resources.infosecinstitute.com/data-exfiltration-techniques/ I am teaching myself to identify exfiltration of sensitive data with malicious binaries. One thing I have noticed, is in most ...
1
vote
1answer
100 views

How to change PE signature? [closed]

I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool ...
-1
votes
1answer
63 views

How to decide file is malware or not? [closed]

How should I decide file is malware or not. Before reverse engineering any file, I should be suspect the file. What are the various ways to decide if exe is malicious? Thanks
1
vote
0answers
31 views

Malware terminated in Ollydbg after a while - Why? [closed]

I try to analyze a backdoor program with ollydbg. When I go through the assembly code by clicking the "Step Over"-Button, i stop sometimes to make a notice on a paper. Later when i want to go trough ...
6
votes
2answers
279 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format ...
2
votes
1answer
140 views

Alternative to CaptureBAT on Windows 7?

I am working on some malware that currently only runs with Windows 7 is detected. I would like to use CaptureBAT, but it doesn't work on Windows 7 (with the exception of network monitoring). Is there ...
1
vote
1answer
126 views

Are jump instructions targeting addresses in ntdll a sign of malware?

For fun I downloaded an installer from a "driver downloads" website. I do NOT intend on installing it, but I was interested to check it out just to see what it looked like. I tossed it into Ollydbg ...
4
votes
2answers
153 views

How can we determine that malware are related?

I am curious to know about how researchers can know when different malware are related. for example: Stuxnet, Flame or Duqu, are told to be written by the same group. Does anyone know how they figure ...
4
votes
3answers
235 views

How to break on not-yet-loaded kernel driver

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
-3
votes
1answer
159 views

How do anti-virus programs catch a virus? How they detect it? [closed]

I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?
4
votes
2answers
292 views

how to reverse DeviceIoControl?

I have started reversing this piece of malware. At some point it creates a service and starts it, then immediately it calls the function DeviceIoControl and the malware went from "paused" to "running" ...
3
votes
1answer
186 views

Trouble analyzing a ransomware

I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps : When loaded in Ollydbg it pauses at: 00401000 > $ 8D9404 ...
6
votes
4answers
349 views

How antiviruses name malwares

While analyzing a binary online through the virustotal service , I found out that different AVs named the binaries differently.For instance, for that same binary Norman named it Obfuscated_A, ...
-2
votes
4answers
840 views

Does learning Metasploit help me in reverse engineering and malware analysis?

I learned basis of assembly language with, both, AT&T and Intel style. After that I gone through buffer overflow and how to use shellcode with it. Should I go for Metasploit now?
1
vote
1answer
226 views

How to dump a DLL not listed using Process Explore and similar tools

I am trying to reverse engineer a DLL that may contain malware. One thing I noticed is that it hides itself from the DLL LDR_MODULE list. So, when I use Ollydbg or smiler tools I do not see it and ...
3
votes
1answer
102 views

IDA debugging API's security

I recently saw funcap, a plugin that captures function calls made by a binary using IDA's debugging API. I have setup IDA on my host machine. My VMs aren't fast enough to run IDA in them. How do you ...
3
votes
3answers
463 views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
1
vote
3answers
380 views

Malicious word document shellcode extraction

I am playing with some malicious MS Word documents which exploit a vulnerability in Word 2k3/2k7 to launch the shellcode. I am able to run it dynamically and get the drop-bys. However, I am interested ...
2
votes
1answer
169 views

What Honeypots are recommended to capture malwares (for analysis)? [closed]

I want to operate honeypots for malware analysis purpose and packet capture. What honeypots are recommended for beginners ? And, what is the best to set-up an honeypot, should it be in a real machine ...
2
votes
1answer
166 views

Detailed description of malware content [closed]

I have just started my journey into the vast and intersting field of malware analysis. I would like to know if there is any website/book or another resource that explains what a particular block of ...
2
votes
1answer
390 views

Intro to reverse engineering [closed]

I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in ...
8
votes
3answers
1k views

Which IDA Pro Signature should be used for Borland Delphi 6.0-7.0 binaries as reported in PEiD?

I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using ...
7
votes
3answers
496 views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
2
votes
1answer
156 views

Decoding Malware javascript [closed]

My .php and .js files have been attacked twice in a month with some JavaScript code. After going through this similar thread, I ran the JavaScript code posted there and found this decoding result. ...
1
vote
1answer
272 views

Find out decrypted body of Polymorphic malware

I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its ...
3
votes
2answers
767 views

How to unpack files packed with multiple packers?

As I am just getting started in RE, I've mostly faced files packed with a single-layer of packing , such as UPX, ASPack, etc. Unpacking these protections is fully documented online. The problem ...
7
votes
5answers
552 views

Malware in virtual machines

Once I perform static analysis on a malware sample, I next run it in a virtual machine. Does this give the malware a chance to spread to the real machine? Does this give the malware a chance to ...
-1
votes
1answer
209 views

What should I look for when building a malware lab on a budget? [closed]

What should I look for when building a malware lab on a budget? $800 USD or less. I'm talking about hardware and virtualization capabilities, or alternatives (e.g. FOG Server). Not user programs ...
8
votes
3answers
523 views

How to get virus body of Polymorphic Malware

I want to decrypt polymorphic malware and want to get actual virus body which is going to do infection. I tried to decrypt virut.ce (this is one polymorphic malware) in ollyDbg but it is using anti ...
4
votes
3answers
440 views

What is this obfuscation method called?

I have recently seen the following code obfuscation method: ... jump loc_1234 ;------------------------- Bunch of junk ;------------------------- loc_1234: code continued... The logic ...
3
votes
3answers
197 views

Tool for checking if there is any patch in the loaded module

I'm looking for a tool that is able to check loaded module for any placed patches even on not exported functions. I'm aware of Gmer, RKU and Co. and frankly I don't really trust their results.
4
votes
1answer
212 views

Prevent malware from deleting itself during installation on Windows x64

Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection. I've looked at CaptureBat, but its ...
4
votes
1answer
229 views

How to handle exceptions in a debugger when reversing malware?

I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When ...
1
vote
2answers
235 views

How to get all the references to function using PyDBG?

I'd like to get all the addresses in the binary that some function is called from using PyDbg. The address of the function will be supplied as a parameter. Do I have actually to scan all the code, ...
12
votes
3answers
1k views

How do AV vendors create signatures for polymorphic viruses?

I was working on a hobby AV project using ClamAV's engine. While ClamAV is a good open source engine, it has poor support for detecting polymorphic viruses. The latest updated version failed to detect ...
2
votes
0answers
37 views

How to add xrefs to indirect call targets in IDA? [duplicate]

I was analyzing win32.ramnit's dropper for fun. Almost all the calls it uses are indirect calls. I have figured out the destination addresses using manual analysis. But how can I add this information ...
3
votes
2answers
577 views

How to load a dumped process and several accompanied memory pages in IDA?

I have dumped process and several dumped pages of memory that were allocated in it. How can I load everything in IDA into one DB and reference pages in the loaded process?
6
votes
4answers
368 views

Program with no dependencies

while reading the answers to Can I statically link (not import) the Windows system DLLs? I came up with another question. So: Is there a way to write a program that has no dependencies (nothing is ...
2
votes
0answers
70 views

Opinions and suggestions regarding malware sandboxes [closed]

I'm relatively new in the field of automatic malware analysis and I'd like to ask about hands-on opinions about sandboxes in the following aspects: extensibility of the product - adding your own ...
7
votes
2answers
2k views

Difference between DllMain and DllEntryPoint

I have a piece a malware I was share with. (I do this for fun, anyways) Is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the ...
2
votes
0answers
157 views

MITRE MAEC (Malware Attribute Enumeration and Characterization) opinions and usage [closed]

I was looking at some MITRE projects and was wondering what you thought about, and if anyone was using or contributing to, the MITRE Malware Attribute Enumeration and Characterization project: ...
12
votes
4answers
956 views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
5
votes
1answer
170 views

Strange GDB behavior in OSX

I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...
6
votes
2answers
418 views

FEEDFACE in OSX malware

I was reverse engineering a piece of code in "Crisis" for fun and I encountered the following :- __INIT_STUB_hidden:00004B8F mov eax, 8FE00000h __INIT_STUB_hidden:00004B94 ...
3
votes
2answers
234 views

Why does an executable give an error when opened in $tool?

I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
3
votes
1answer
161 views

How did/would you analyze OSX-Crisis

I was taking a look at the OSX-Crisis sample obtained from this site and trying to analyze it for fun and learning. Choosing to disassemble as a Mac binary causes the start function to be discovered ...
9
votes
2answers
1k views

What are the different types of packers?

I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved. Yet, it seems that ...
14
votes
5answers
1k views

How to capture an “in-memory” malware in MS-Windows?

I have an infected MS-Windows 7 machine with an in-memory malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some ...
3
votes
0answers
325 views

How accurate is Cerberus for reverse engineering malware? [closed]

AccessData's Cerberus product claims to be : The first step towards automated reverse engineering, Cerberus allows you to determine the behavior and intent of suspect binaries, giving you ...