Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

0
votes
0answers
47 views

Reverse engineering .NET malware - iloveyou.exe

I have a .NET malware sample whose dynamic behavior I understand. It is also packed. de4dot identified the obfuscator as .NET Reactor, so I used de4dot to de-obfuscate it. However, after de-...
0
votes
0answers
48 views

idapython - Scan all possible code paths between start and end addresses

I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
1
vote
0answers
49 views

How can I extract resource images from Visual Basic 6 Malware

I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I ...
0
votes
1answer
115 views

Detecting cracked Themida packed malware

I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples. As alluring as it is to suggest just blacklisting all Themida ...
1
vote
1answer
63 views

Difficulty in debugging with dnSpy

I have a dotnet malware sample that I'm trying to debug with dnSpy. It has string obfuscation (contains function names such as BarriersBottomed, etc.) I cleaned the sample using de4dot and renamed ...
0
votes
1answer
89 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
0answers
32 views

Replacing a function call with it's result in a script

I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function. The problem is that this ...
0
votes
3answers
190 views

Most efficient way to begin analyzing malware binary

I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
0
votes
2answers
289 views

What's happening in the assembly main function?

I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here. Where should I set the breakpoints (...
0
votes
1answer
51 views

what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify

How can these pe attributes be used to identify malware. I was going though a paper link at page 10 he mentioned. "BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary ...
-1
votes
2answers
111 views

CreateThread returns true but thread doesn't run [closed]

I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions. The call to the CreateThread returns a valid handle ...
1
vote
2answers
130 views

Emotet invoice, what is the embedded file inside the word document

This pastebin hosts current URLs hosting the fake invoice of Emotet malware, which is the dropper part of the malware. The document is a Office Open XML, and there are two large non textual segments ...
0
votes
1answer
90 views

ida pro issue debugging issues with ntdll [closed]

I am using IDA pro to follow along a youtube video of RE from OALabs. https://www.youtube.com/watch?v=kdNQhfgoQoU&t=1575s I am facing a problem when i try to put a break point on functions in ...
3
votes
3answers
298 views

Academic journals for latest RE/Malware/Exploitation research?

I am looking for journals to keep track of the latest advances in reverse engineering, binary analysis, malware, binary exploitation, etc.
0
votes
2answers
77 views

capturing the sub processes's PID of a process

When a program is executed, some processes may be created by the parent process. Especially, if a program is malware, created (or forked or even injected) sub-processes will be named as a systemic ...
0
votes
1answer
61 views

Reverse engineering Infostealer.Dyre

I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre malware sample from theZoo on GitHub and I've been trying to analyze it. I've put up my analysis report here. ...
3
votes
2answers
180 views

Manually unpacking DarkTequila, stumped. Can anyone help?

The malware is packed w/ UPX - can see 0/1 in sections. Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
1
vote
1answer
474 views

How to convert Unexplored data in IDA Pro to code?

I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
2
votes
1answer
191 views

General unpacking of packed malware

I did a brief survey on malware unpacking and I found several theses on automated general unpacking:Eureka, PolyUnpack, omniUnpack, Malware Normalization. However, these theses are written years ago ...
-1
votes
1answer
124 views

Finding a specific malware sample [closed]

I am trying to find for analysis the scuinst.exe binary (R2D2 aka Bundestrojaner), but I can not find it. Where can I find this binary?
0
votes
0answers
86 views

Using yara to obtain information from binary (not matching)

I would like to use yara to extract information from a binary. I went through the doc but did not understand how to always get a certain piece of information. For example: import "dotnet" rule ...
5
votes
1answer
97 views

How can you explore behavior in malware that is not being performed?

I have a malware sample that I know is acting as a bot and connects to a botnet. The problem is that it uses no known protocol that I am familiar with (it's IRC-like) and doesn't actually do anything ...
1
vote
1answer
384 views

What location is this and what does it signify - “d:\w7rtm\minkernel\ntdll\ldrinit.c” [duplicate]

Came across this while debugging a exe. Cant find much on it anywhere so thought I'll put it up here. Any ideas as to what this could be used for? CPU Disasm Address Hex dump Command ...
5
votes
3answers
162 views

Finding a malware object inside PE file

Today my AV found an antique piece of malware called Win9X.CIH.dam. Instead of just removing it I would like to make a little research for fun. What does "data0513" exactly mean? I can't understand ...
1
vote
0answers
50 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
0
votes
1answer
55 views

Identifying code that accesses encrypted overlay in PE

I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the ...
1
vote
1answer
365 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
1
vote
0answers
191 views

ELF .text infection test

I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
-2
votes
2answers
414 views

How can I export only the mnemonics from objdump (or any other program)?

I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this? In other words of this output of objdump (objdump -d ...
0
votes
2answers
1k views

Dumping dll out of process

So there is executable malware, what when opened downloads dll from server or so and injects into target process. I checked properties of the target process in process hacker and clicked on .NET ...
1
vote
1answer
148 views

De-obfuscation - Emulation-oriented vs Script-oriented

What are the advantages of each method when employing de-obsfucation of potentially malicious code? I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
1
vote
2answers
95 views

Test malware files in host machine?

To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly. I want to know how to test malware files with out ...
4
votes
4answers
9k views

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
1
vote
1answer
114 views

Rootkit.Fileless.MTGen Reverse Engineering

Has anyone tried seeing what's inside of this malware? It ended up on one of our work machines. I copied the files to a thumb drive before setting the machine up for reimaging. Though the AV software ...
1
vote
1answer
152 views

Which RE tool is missing?

I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not. My problem is, that all the filenames and ClassNames are ...
-1
votes
1answer
208 views

Whether samples downloaded from virus share can execute automatically in my computer

I am doing some android malware analysis work and downloaded many android samples in virus share, but I found some of them are windows malware e.g. labeled 'win32' or something. Are these windows ...
0
votes
1answer
165 views

ELF64 Reflective Loading [closed]

I'm looking for an ELF64 reflective loader, so I can download an ELF and execute it without saving to disk? Is anyone able to point me at one please? Or a clear one for ELF32 so I can translate? ...
0
votes
1answer
160 views

Pyemu - cannot use PEPyEmu() module, Python

I want to run code from Gray Hat Python book for upx_unpacker. I have downloaded PyEmu, but when I run script I got this error: AttributeError: PEPyEmu instance has no attribute 'load' My script use ...
-2
votes
1answer
79 views

Malware static rules? [closed]

Is there any sites to get static rules to detect malware files? static behavior rules for detecting malware files. Thanks in advance.
0
votes
1answer
103 views

Configuring a C&C for a RAT [closed]

Where would I start when needing to configure a command and control server for a RAT? So that my dynamic analysis can be more complete. Note: I have been to the topics section of this stack exchange....
0
votes
2answers
69 views

Composition of a Binary File trouble [closed]

I am working with some malware samples and I need to determine if one of them is primarily composed of 32-bit Intel Code. This would seem easy as I can just check the metadata describing it as a 32-...
0
votes
2answers
2k views

How to unpack and decrypt malware? [duplicate]

Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
2
votes
0answers
791 views

Unable to unpack heavly obfuscated malware

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted. I tried all possible tools that I found ...
4
votes
2answers
212 views

Analysing malware in a real environment (non-virtual environment)

I have analysed malware previously using Cuckoo Sandbox, however, I've seen that some malware won't run as they detect they are actually running in a virtual environment (they implement some anti-...
0
votes
1answer
184 views

2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]

So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
0
votes
1answer
127 views

I'm would like to view this malicious payload, but am having trouble decoding it

This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this? H4sIAAAAAAAAAL1X6W6jyBb+...
3
votes
1answer
467 views

Resolve Addresses To Function Names

I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
1
vote
1answer
123 views

What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?

I was looking at the paper: "Improved Detection for Advanced Polymorphic Malware" by James Fraley who claimed to have used static, dynamic and file properties for increased malware detection. But is ...
5
votes
2answers
550 views

Reversing Self-Modifying Malware

recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
1
vote
0answers
902 views

Attaching to Dalvik static function using Frida in order to disable emulator detection

I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get ...