3

I am testing a malware that built as COM EXE service. This exe file has a digital signature.
I succeeded to remove the digital signature for trying to modify it for reverse engineering tests.

But when I open it in OllyDbg and make any tiny change, the malware crash and not runs at all. Even if I tries to change one byte in the code cave to nop command, the malware not running.

Why can't I change it even in the code cave? Any idea?

Improve this question
2
  • This could be anything. You need to provide a lot more information to get any meaningful answer.
    – Guntram Blohm
    Commented Jun 1, 2016 at 12:11
  • It could be tamper protection. For example, calculating the hash value of the code and checking it against a "good" hash value.
    – JeffreyZ
    Commented Jun 1, 2016 at 16:21

2 Answers 2

Reset to default
0

Maybe the malware have a hash like "SHA1" of its own code so when the malaware run he will check the checksum of executable in memory and compare the hash of memory with the one included in code

try to see at starting point what the malware is doing like memory raiding and also search where he call the exit() function or any function that will make it exit

Improve this answer
0

@Karim's idea is right. Another thought is that your malware might be checking windows' registry debug flags. Since Olly runs dynamic analysis, your .exe recognises it and stops working if any changes applied during debugging proccess.

Improve this answer
2
  • I am not changing it while debugging.. I change it, save it as new EXE and tries to run it without any debugger
    – nrofis
    Commented Jun 4, 2016 at 14:42
  • Well, then your malware is probably using some code integrity verification mechanism, like the hashing mentioned. Try to look out in the code for that, disable it and the modify anything else in the code.
    – Chris Tsiakoulas
    Commented Jun 4, 2016 at 17:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.