All Questions
Tagged with deobfuscation malware
6
questions
0
votes
0answers
96 views
Reverse engineering .NET malware - iloveyou.exe
I have a .NET malware sample whose dynamic behavior I understand. It is also packed.
de4dot identified the obfuscator as .NET Reactor, so I used de4dot to de-obfuscate it. However, after de-...
0
votes
0answers
36 views
Replacing a function call with it's result in a script
I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function.
The problem is that this ...
1
vote
1answer
196 views
De-obfuscation - Emulation-oriented vs Script-oriented
What are the advantages of each method when employing de-obsfucation of potentially malicious code?
I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
1
vote
2answers
611 views
Debugging Win32.Upatre - why does Ollydbg fail to analyze this?
So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze?
And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog.
I started analyzing ...
2
votes
1answer
497 views
Decoding Malware javascript [closed]
My .php and .js files have been attacked twice in a month with some JavaScript code.
After going through this similar thread, I ran the JavaScript code posted there and found this decoding result.
...
68
votes
9answers
64k views
Analyzing highly obfuscated JavaScript
I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
