0

I am new to malware analysis .. and I was analyzing some 'windows' apps and found functions that I thought it exist only on malware, is this possible or there is something wrong with my analysis ? I am using Cuckoo sandbox .. the functions are: SetWindowsHookExA, IsDebuggerPresent .. and others as well

One of the app examples is AcroRd32.exe: It calls IsDebuggerPresent .. and this is its page on virustotal including all the information related to the sample in addition to the MD5. https://www.virustotal.com/en/file/9e702e7b53f6f00e344a1cb42c63eaf4d52ed4adb5407744a654753569044555/analysis/

  • 2
    These API calls have been added by Microsoft for certain reasons they had. Obviously Microsoft didn't create them for use exclusively by malware. It's just that they are more commonly used by malware. It's a probability question. – Vitaly Osipov Aug 4 '16 at 6:59
  • Where did you get the idea that these functions should only be used by malware? Following your logic, why would you think Microsoft created such functions in the first place? To aid malware developers? :D – Dominik Antal Aug 5 '16 at 18:02
  • I a newbie to both the APIs and malware analysis .. and I don't have a full understand of both yet .. So we usually ask to learn from people like you :) – Ophilia Aug 7 '16 at 12:00
6

IsDebuggerPresent is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for SetWindowsHookExA, so you will often see them in clean executables.

0

Yeah, there are definitely legitimate use cases for both IsDebuggerPresent and SetWindowsHookExA common windows functions.

I propose you a simple experiment you can try, take this little legitimate c++ snippet of mine:

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

void main(int argc, char* argv[]) {
    printf("Hello world\n");
    while(true) {
        printf("Debugger present: %d\n", IsDebuggerPresent());
        Sleep(200);
    }
    system("pause");
}

Build it with your favourite c++ windows compiler and run it. Now, take your favourite debugger, I recommend you x64dbg and try this:

  • Attach and detach to the running process to see how IsDebuggerPresent changes
  • Once it's attached, try to hide the debugger

By doing so, you'll understand the very basics about IsDebuggerPresents.

About SetWindowsHookExA, I've seen it used on legit apps countless times so I can guarantee you is definitely not a microsoft function whose purpose is to be used on "naughty" apps :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.