Skip to main content
Reverse Engineering

Return to Question

Tweeted twitter.com/#!/StackReverseEng/status/460579546514096128
Better usage of the wiki syntax
Source Link
perror
perror
  • 19.2k
  • 29
  • 87
  • 150

For fun I downloaded an installer from a "driver downloads" website. I do NOT intend on installing it, but I was interested to check it out just to see what it looked like. I tossed it into ollydbgOllydbg (without advancing the pointer) and just browsed the assembly.

There are multiple different calls/jumps/far jumps to various "ntdllntdll.addr.addr"

I know ntdllntdll is a pretty low-level library, but I just don't have enough experience in windows x86 disassembly to know what's "normal'normal'." This is also ostensibly, a driver installer, so it seems reasonable that there would be calls into ntdllntdll. Are jumps like that considered normal behavior? Usually I'm used to seeing calls that expressly name the function... not a specific address in ntdllntdll.

Extra detail/context

--Extra detail/context-- The The file wasn't packed, but there were a few spots where the full printable ASCII [A-Za-z] appeared in the hex view, which I recall could be a sign that there's base64 encoding/decoding going on somewhere. Maybe shift-ciphers.

For reference, the precise binary I'm peering into is here. Windows 7 64b64bits. (The installer itself appears to be 32b32bits... ollyOllydbg loaded it fine, and IDA free too.)

PEBrowse64 also showed me something possibly suspicious under Resources->STRING->4085Resources->STRING->4085.

inIn this section there appears to be strings set aside for pageupPageup/downDown/backspaceBackspace/escEsc/enterEnter keys, which I know could be a sign of a keylogger... but again, I'm new, so I'm unsure.

For fun I downloaded an installer from a "driver downloads" website. I do NOT intend on installing it, but I was interested to check it out just to see what it looked like. I tossed it into ollydbg (without advancing the pointer) and just browsed the assembly.

There are multiple different calls/jumps/far jumps to various "ntdll.addr"

I know ntdll is a pretty low-level library, but I just don't have enough experience in windows x86 disassembly to know what's "normal." This is also ostensibly, a driver installer, so it seems reasonable that there would be calls into ntdll. Are jumps like that considered normal behavior? Usually I'm used to seeing calls that expressly name the function... not a specific address in ntdll.

--Extra detail/context-- The file wasn't packed, but there were a few spots where the full printable ASCII [A-Za-z] appeared in the hex view, which I recall could be a sign that there's base64 encoding/decoding going on somewhere. Maybe shift-ciphers.

For reference, the precise binary I'm peering into is here. Windows 7 64b. (The installer itself appears to be 32b... olly loaded it fine, and IDA free too.)

PEBrowse64 also showed me something possibly suspicious under Resources->STRING->4085

in this section there appears to be strings set aside for pageup/down/backspace/esc/enter keys, which I know could be a sign of a keylogger... but again, I'm new, so I'm unsure.

For fun I downloaded an installer from a "driver downloads" website. I do NOT intend on installing it, but I was interested to check it out just to see what it looked like. I tossed it into Ollydbg (without advancing the pointer) and just browsed the assembly.

There are multiple different calls/jumps/far jumps to various ntdll.addr.

I know ntdll is a pretty low-level library, but I just don't have enough experience in windows x86 disassembly to know what's 'normal'. This is also ostensibly, a driver installer, so it seems reasonable that there would be calls into ntdll. Are jumps like that considered normal behavior? Usually I'm used to seeing calls that expressly name the function... not a specific address in ntdll.

Extra detail/context

The file wasn't packed, but there were a few spots where the full printable ASCII [A-Za-z] appeared in the hex view, which I recall could be a sign that there's base64 encoding/decoding going on somewhere. Maybe shift-ciphers.

For reference, the precise binary I'm peering into is here. Windows 7 64bits. (The installer itself appears to be 32bits... Ollydbg loaded it fine, and IDA free too.)

PEBrowse64 also showed me something possibly suspicious under Resources->STRING->4085.

In this section there appears to be strings set aside for Pageup/Down/Backspace/Esc/Enter keys, which I know could be a sign of a keylogger... but again, I'm new, so I'm unsure.

Source Link
avgvstvs
avgvstvs
  • 620
  • 3
  • 13

Are jump instructions targeting addresses in ntdll a sign of malware?

For fun I downloaded an installer from a "driver downloads" website. I do NOT intend on installing it, but I was interested to check it out just to see what it looked like. I tossed it into ollydbg (without advancing the pointer) and just browsed the assembly.

There are multiple different calls/jumps/far jumps to various "ntdll.addr"

I know ntdll is a pretty low-level library, but I just don't have enough experience in windows x86 disassembly to know what's "normal." This is also ostensibly, a driver installer, so it seems reasonable that there would be calls into ntdll. Are jumps like that considered normal behavior? Usually I'm used to seeing calls that expressly name the function... not a specific address in ntdll.

--Extra detail/context-- The file wasn't packed, but there were a few spots where the full printable ASCII [A-Za-z] appeared in the hex view, which I recall could be a sign that there's base64 encoding/decoding going on somewhere. Maybe shift-ciphers.

For reference, the precise binary I'm peering into is here. Windows 7 64b. (The installer itself appears to be 32b... olly loaded it fine, and IDA free too.)

PEBrowse64 also showed me something possibly suspicious under Resources->STRING->4085

in this section there appears to be strings set aside for pageup/down/backspace/esc/enter keys, which I know could be a sign of a keylogger... but again, I'm new, so I'm unsure.