3

I am testing a malware that built as COM EXE service. This exe file had a digital signature.
I succeeded to remove the digital signature for trying to modify it for reverse engineering tests.

But when I open it in OllyDbg and make any tiny change, the malware crash and not runs at all. Even if I tries to change one byte in the code cave to nop command, the malware not running.

Why can't I change it even in the code cave? Any idea?

  • This could be anything. You need to provide a lot more information to get any meaningful answer. – Guntram Blohm supports Monica Jun 1 '16 at 12:11
  • It could be tamper protection. For example, calculating the hash value of the code and checking it against a "good" hash value. – JeffreyZ Jun 1 '16 at 16:21
0

Maybe the malware have a hash like "SHA1" of its own code so when the malaware run he will check the checksum of executable in memory and compare the hash of memory with the one included in code

try to see at starting point what the malware is doing like memory raiding and also search where he call the exit() function or any function that will make it exit

0

@Karim's idea is right. Another thought is that your malware might be checking windows' registry debug flags. Since Olly runs dynamic analysis, your .exe recognises it and stops working if any changes applied during debugging proccess.

  • I am not changing it while debugging.. I change it, save it as new EXE and tries to run it without any debugger – nrofis Jun 4 '16 at 14:42
  • Well, then your malware is probably using some code integrity verification mechanism, like the hashing mentioned. Try to look out in the code for that, disable it and the modify anything else in the code. – Chris Tsiakoulas Jun 4 '16 at 17:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.