Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Filter by
Sorted by
Tagged with
2
votes
1answer
157 views

The Knowledge of Compiler for becoming a good Reverser

I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
2
votes
1answer
46 views

Is there an easier way to break on a rootkit driver load, other than disassembling IopLoadDriver?

The only method i know to break on a DriverEntry of a rootkit driver when its loaded is to disassmble nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on ...
1
vote
1answer
50 views

Using windows 10 for malware analysis

I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
1
vote
0answers
18 views

Jumping to a specific logation for DLL injection : OllyDbg

Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates: Can I call a jmp function ...
2
votes
1answer
35 views

Shannon Entropy of Individual PE sections

Why is Shannon Entropy of individual sections always between 0-8. Also why we need to create a 256 freq array while calculating the Shannon Entropy?
0
votes
2answers
61 views

cdecl calling convention

Hello best people, my question is this example is telling me about cdecl calling convention. I have confusion that when analyzing the code in disassembly how would I recognize that this is the cdecl ...
4
votes
3answers
2k views

Is Null in Windows equal to zero?

(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
1
vote
1answer
70 views

Mul(Multiplication) in x64 and in x32 assembly

I'm completely new in malware reverse engineering. I'm stuck in a confusion that, I studied that in x32, mul instruction multiplies the source with eax register and store the result as 64 bit value ...
1
vote
1answer
58 views

Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?

I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
-2
votes
1answer
88 views

Is this an endless loop?

I saw this part of the code in practical malware analysis. This construct is a loop for sure, but there isn't any condition. Is this an endless loop?
1
vote
1answer
87 views

Does the operating system you use matter?

people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
0
votes
1answer
75 views

what is Off in IDA Pro?

probably silly question, what does Off ... means in IDA Pro? i markered the snapshot as an example.
0
votes
0answers
72 views

IDA IDC script does not seem to work

I am trying to measure code coverage for a malware sample linked here. I am using DynamoRIO's(7.1.0-1) drcov utility to get an ASCII log. The log file is linked here. I am then using Dynapstalker to ...
0
votes
1answer
100 views

How can I de-obfuscate a VBScript (.vbs) file?

I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
-1
votes
2answers
91 views

Ransomware Source Codes [closed]

Have been searching ransomware source codes for analysis(as much as possible). I have already checked with sites like Any.Run but most of their samples are .exe and binary files. Does any one have any ...
1
vote
1answer
85 views

Disassemble and debug dynamic generated code executed via delegate in c#

I'm trying to reverse engeneer a malware using dnSpy that at some point do this: delegate IntPtr H7IREAEBYY(string path, IntPtr data); byte[] array = new byte[] { 233, 151, ... } IntPtr value ...
2
votes
1answer
48 views

Structure of operand bytes in .NET call and data access IL instructions?

I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions for example based on experience, the last byte of API/...
1
vote
0answers
47 views

Ways of creating a new thread on Windows

I'd like to know about every possible way how a thread can be created in a process at the lowest possible level. There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
0
votes
0answers
115 views

Bypass anti memory dump with process hacker and dump the malware?

I have a malware that has some sort of anti dumping technique, so when i dump a region of memory with process hacker it dumps a 0 byte file, i am also running the process hacker as a unrestricted user ...
4
votes
1answer
163 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
0
votes
0answers
23 views

How to check in IDApython that if a call is an API/Library call or not?

I want to check for every call instruction whether its an API call or library call (statically linked that flirt recognized) The only solution i found is this : Finding all API calls in a function but ...
0
votes
2answers
83 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
1
vote
0answers
35 views

How are AutoIT variable names stored after compiling it to a executable?

I need to write a yara rule for a autoit malware (the binary itself not the decompiled script) As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
1
vote
1answer
252 views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
0
votes
1answer
66 views

Debugging Encrypted Malware with Multiple Threads

What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
-2
votes
1answer
134 views

How to reverse engineer apks? [closed]

is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
-1
votes
1answer
60 views

Force debug Administrator Malware

I want to analyse a malware that do not run without administrative previliges. I know it is risky but still. How can I debug it with debugger as from entry point? Because debugger could not start ...
1
vote
1answer
65 views

Code based Yara rule

I have to write a Yara rules for malwares that is based on assember code. Suppose I have an unpacked malware sample. To avoid false positives, the selected code must be unique. Can anyone tell me ...
0
votes
0answers
2k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
0
votes
0answers
43 views

How to view all of the struct member values in IDA pro?

The problem i am having in reading the struct values is that in the decompiler, when the struct is too large i cant view all the values when i hover over the structure member : Tried viewing these ...
0
votes
2answers
116 views

Is there any way to write a IDA script that finds constant values used in all functions, no matter the instruction?

So lets say i have these type of instructions in functions : x == constant value x = constant value x > constant value no matter if its just an assignment or compare or anything, i want to get the ...
0
votes
0answers
36 views

Is there any tool that finds common things like strings among large number of binaries?

So this is really needed in malware analysis, for example if i have 1000 samples from a family and i want to know which strings are common among all of them, it would really help to have a tool that ...
0
votes
1answer
92 views

Malware attempting to move a value into $zero in MIPS?

Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times. addiu $zero, 0xA as well as move $at, $at ...
1
vote
2answers
280 views

What does objdump -b binary means?

So I have started to digging in malware analysis and I came across with some malware samples that I couldn't disassembly with objdump. More specifically I use objdump -dS /path/to/malware and I got ...
0
votes
0answers
17 views

Passing file through inetsim

I have a piece of malware that downloads a config file from a google drive link, and I want to determine how the config file is used and where it beacons to without running the file connected to the ...
0
votes
3answers
95 views

What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?

What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
0
votes
3answers
209 views

How To Identify Which Process Is Being Written To With WriteProcessMemory?

Basically, I cannot find which process is being written to when WriteProcessMemory is being called. Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
0
votes
1answer
79 views

Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?

So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
1
vote
1answer
33 views

Android dynamic UI state inspection/profiling tool

I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector. Is ...
2
votes
1answer
69 views

How to “unprotect” malicious workbook without knowing password

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
0
votes
1answer
31 views

Linux encryption/luks/pymouth password scripts corruption

I noticed that the bootup scripts that collect the password for full disk encryption on linux (fedora-31) were displaying corrupted text. The kind that looked like binary data being printed at text: ...
0
votes
1answer
254 views

Obfuscated VBE malware script analysis

Some actions of this script are clear e.g. the section that adds firewall rules, others not so much On Error Resume Next F27 F10 A0 DBCF Sub F27() Dim E13C563AFCB34, C0009B48F34B, C8, ...
1
vote
0answers
49 views

How does this wannacry sample work?

I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive. I figured out how most of the binary works, except the very last ...
3
votes
1answer
184 views

CreateTimerQueueTimer arguments differs from WinAPI

I was reading a man page about CreateTimerQueueTimer. BOOL CreateTimerQueueTimer( PHANDLE phNewTimer, HANDLE TimerQueue, WAITORTIMERCALLBACK Callback, PVOID ...
2
votes
2answers
233 views

Fileless malware samples

If file-based malware sample can be downloaded from sites such as theZoo aka Malware DB or any sites as suggested here, what about fileless malware as it doesn't store it's copy in the hard disk? If ...
1
vote
2answers
1k views

Why Windows Defender is not able to get rid of this trojan?

Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
1
vote
0answers
75 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
1
vote
3answers
224 views

What is the difference between malware that is 'dumped' and one that is 'unpacked'?

On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
0
votes
1answer
59 views

What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?

Sorry if this is a stupid question but couldnt find the answer by googling Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
0
votes
2answers
107 views

Tools for detecting packing and encryption

I'm doing a cert in malware analysis and I'm looking for some up to date tools to automate detection of packing and encryption to aid the reversing process. I've found TitanMist however it seems ...

1
2 3 4 5 6