Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Filter by
Sorted by
Tagged with
0 votes
1 answer
64 views

Hex editing an IP address of a different length

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
user avatar
2 votes
1 answer
74 views

x64dbg : TraceInto only in user code

The question seems pretty simple, but I can't achieve this simple thing in a reasonable time. I have a malware proceeding to deobfuscate a large amount of APIs in memory. Only the pointer to the ...
user avatar
  • 23
3 votes
0 answers
55 views

How to analyze EFI dynamically?

I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver. I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
user avatar
  • 83
1 vote
0 answers
44 views

CFT challenge with Trojan malware?

I am trying to solve a CTF challenge with levels with escalating difficulty. At this point, the program (PE32 executable) is detected as malware (wacatac to be more precise) by Windows Defender. It ...
user avatar
1 vote
1 answer
49 views

Does opening a crash dump run a file in memory?

I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
user avatar
0 votes
0 answers
56 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
user avatar
0 votes
0 answers
44 views

Malware analysis of undetected NodeJS token grabber

I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'. Someone contacted me asking to playtest a game, which prompted a .exe file. I ran the file and website on ...
user avatar
0 votes
0 answers
96 views

Decompiling a Node.js application compiled with nexe

Someone have sent a Discord token stealer and out of curiosity, I would like to decompile it, just to get some info about the attacker. Judging by folders created in my user directory, multiple ...
user avatar
0 votes
1 answer
101 views

decoding thread context structure in x64dbg

Is there any way to decode the thread context structure returned by "GetThreadContext" and used by "SetThreadContext" in x64dbg?
user avatar
1 vote
1 answer
61 views

What is the meaning of SYSTEM_INFO.wProcessorLevel?

I am performing some RE on a malware sample, and they are checking the value of SYSTEM_INFO[32] which is SYSTEM_INFO.wProcessorLevel. The description MS provides is not clear to me. The malware checks ...
user avatar
0 votes
1 answer
72 views

Decode byte numbers into string

There is this grabber called Itroublve grabber, which a lot of people use, and I wondered what it's aes encryption key is, so I looked at the code, and I found this: Key = new byte[] { ...
user avatar
  • 15
3 votes
0 answers
99 views

Is it possible to fake being joined to a domain in Windows 10?

I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain. Rather than standing up my own ...
user avatar
  • 131
0 votes
1 answer
84 views

Problem with analyzing malware

We have a malware that blocks all analytics software in real time. This software has blacklisted a large list of software that performs analysis (x64dbg, ida, serialport monitor, etc.) This software ...
user avatar
  • 21
0 votes
0 answers
48 views

How to extract an AutoIT script when tools fail to extract it?

Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it. What would you do? is there any place in ...
user avatar
0 votes
2 answers
108 views

Format of data in the .code/.text section

I'm attempting to dissect/disassemble a windows PE file under Linux using objdump. On surface analysis, the .code section was disassembled to : tmp.exe: file format pei-i386 Disassembly of ...
user avatar
  • 125
0 votes
0 answers
49 views

viewing debugging symbols in windbg

I am currently learning Malware Analysis using the book "Practical Malware Analysis", and I am going along with the chapter on Kernel debugging. When viewing the same code snippet on WinDbg ...
user avatar
  • 1
1 vote
0 answers
37 views

Capturing created and deleted files from a Java file

I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
user avatar
2 votes
1 answer
169 views

Want to use win API hooking to detect wmi query string? But can't find IWbemServices::ExecQuery in fastprox.dll

I want to implement WMI query detection function using apimon plugin in sandbox https://github.com/tklengyel/drakvuf To do it,I have to get the DLL symbol file. But I can't locate the IWbemServices::...
user avatar
0 votes
1 answer
83 views

Understanding the basics of Reverse Engineering a segment of code

Currently trying to understand the following code and what it is doing. mov eax, 1 test eax, eax jz loc_411503 mov esi, esp call ds:_kbhit cmp esi, esp call sub_411159 test ...
user avatar
2 votes
1 answer
192 views

Analyzing a possibly malware sample

I am trying to analyze a possible malicious sample. It's a windows executable e3f04124e2e26f8f030f6845086875a9 Md5sum Intel 386 or later processors and compatible processors File 2464.exe 2464.exe: ...
user avatar
  • 29
2 votes
0 answers
115 views

Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment

I'm working on a sample that contains packing and anti-analysis measures. Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
user avatar
1 vote
1 answer
279 views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
user avatar
0 votes
0 answers
73 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
user avatar
0 votes
1 answer
86 views

Is there any way to STOP the loop of the IDApython?

Is there any way to STOP the loop of the IDApython ? I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
user avatar
1 vote
3 answers
723 views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
user avatar
1 vote
0 answers
96 views

Best way from high level software developer to malware analyst

I am a software developer with commercial experience in Python and mainly Scala working on high level programming, e.g. REST APIs, and only personal/university projects experience in C++. I would like ...
user avatar
2 votes
1 answer
248 views

The Knowledge of Compiler for becoming a good Reverser

I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
user avatar
2 votes
1 answer
90 views

Is there an easier way to break on a rootkit driver load, other than disassembling IopLoadDriver?

The only method i know to break on a DriverEntry of a rootkit driver when its loaded is to disassmble nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on ...
user avatar
2 votes
1 answer
84 views

Using windows 10 for malware analysis

I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
user avatar
0 votes
0 answers
29 views

Jumping to a specific logation for DLL injection : OllyDbg

Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates: Can I call a jmp function ...
user avatar
2 votes
1 answer
53 views

Shannon Entropy of Individual PE sections

Why is Shannon Entropy of individual sections always between 0-8. Also why we need to create a 256 freq array while calculating the Shannon Entropy?
user avatar
0 votes
2 answers
230 views

cdecl calling convention

Hello best people, my question is this example is telling me about cdecl calling convention. I have confusion that when analyzing the code in disassembly how would I recognize that this is the cdecl ...
user avatar
5 votes
3 answers
2k views

Is Null in Windows equal to zero?

(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
user avatar
1 vote
1 answer
2k views

Mul(Multiplication) in x64 and in x32 assembly

I'm completely new in malware reverse engineering. I'm stuck in a confusion that, I studied that in x32, mul instruction multiplies the source with eax register and store the result as 64 bit value ...
user avatar
1 vote
1 answer
488 views

Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?

I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
user avatar
  • 111
1 vote
1 answer
221 views

Does the operating system you use matter?

people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
user avatar
  • 13
1 vote
1 answer
216 views

what is Off in IDA Pro?

probably silly question, what does Off ... means in IDA Pro? i markered the snapshot as an example.
user avatar
0 votes
1 answer
681 views

How can I de-obfuscate a VBScript (.vbs) file?

I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
user avatar
  • 131
-1 votes
2 answers
196 views

Ransomware Source Codes [closed]

Have been searching ransomware source codes for analysis(as much as possible). I have already checked with sites like Any.Run but most of their samples are .exe and binary files. Does any one have any ...
user avatar
2 votes
1 answer
235 views

Disassemble and debug dynamic generated code executed via delegate in c#

I'm trying to reverse engeneer a malware using dnSpy that at some point do this: delegate IntPtr H7IREAEBYY(string path, IntPtr data); byte[] array = new byte[] { 233, 151, ... } IntPtr value ...
user avatar
2 votes
1 answer
82 views

Structure of operand bytes in .NET call and data access IL instructions?

I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions for example based on experience, the last byte of API/...
user avatar
1 vote
0 answers
68 views

Ways of creating a new thread on Windows

I'd like to know about every possible way how a thread can be created in a process at the lowest possible level. There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
user avatar
6 votes
1 answer
818 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
user avatar
  • 61
0 votes
2 answers
122 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
user avatar
1 vote
0 answers
46 views

How are AutoIT variable names stored after compiling it to a executable?

I need to write a yara rule for a autoit malware (the binary itself not the decompiled script) As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
user avatar
  • 212
1 vote
1 answer
919 views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
user avatar
  • 212
0 votes
1 answer
129 views

Debugging Encrypted Malware with Multiple Threads

What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
user avatar
  • 3
-2 votes
1 answer
186 views

How to reverse engineer apks? [closed]

is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
user avatar
  • 179
-1 votes
1 answer
92 views

Force debug Administrator Malware

I want to analyse a malware that do not run without administrative previliges. I know it is risky but still. How can I debug it with debugger as from entry point? Because debugger could not start ...
user avatar
2 votes
1 answer
99 views

Code based Yara rule

I have to write a Yara rules for malwares that is based on assember code. Suppose I have an unpacked malware sample. To avoid false positives, the selected code must be unique. Can anyone tell me ...
user avatar

1
2 3 4 5
7