Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

0
votes
0answers
22 views

IDA Pro Universal Unpacker not working

I've had success using the Universal PE Unpacker before (in fact yesterday it was working fine) however after loading the malware I'm analysing today it simply does nothing - no errors or any ...
0
votes
0answers
29 views

Deciphering a function in malware analysis

This is far more than I would like anyone to try and decipher, but could anyone provide pointers as to what this function is doing? Or, better yet, tips on how to make sense of this/ tools that can be ...
-1
votes
0answers
21 views

Finding code/comments within IDA shown only by online analysis tool(s)

I'm in the process of debugging some malware (and somewhat a novice) however when ran through an online analysis tool (as shown in the image below) where I browse the streams section it shows comments ...
0
votes
1answer
25 views

capturing the sub processes's PID of a process

When a program is executed, some processes may be created by the parent process. Especially, if a program is malware, created (or forked or even injected) sub-processes will be named as a systemic ...
0
votes
1answer
48 views

Reverse engineering Infostealer.Dyre

I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre malware sample from theZoo on GitHub and I've been trying to analyze it. I've put up my analysis report here. ...
3
votes
2answers
87 views

Manually unpacking DarkTequila, stumped. Can anyone help?

The malware is packed w/ UPX - can see 0/1 in sections. Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
0
votes
0answers
25 views

Where i can download malware for testing? [duplicate]

I have been trying to study for some time some old computer viruses that I had for Windows 3.1, Windows 95, etc. But I can not find any website to download these viruses. I tried to send an email to ...
1
vote
1answer
143 views

How to convert Unexplored data in IDA Pro to code?

I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
2
votes
1answer
97 views

General unpacking of packed malware

I did a brief survey on malware unpacking and I found several theses on automated general unpacking:Eureka, PolyUnpack, omniUnpack, Malware Normalization. However, these theses are written years ago ...
-1
votes
1answer
89 views

Finding a specific malware sample [closed]

I am trying to find for analysis the scuinst.exe binary (R2D2 aka Bundestrojaner), but I can not find it. Where can I find this binary?
0
votes
0answers
32 views

Using yara to obtain information from binary (not matching)

I would like to use yara to extract information from a binary. I went through the doc but did not understand how to always get a certain piece of information. For example: import "dotnet" rule ...
0
votes
0answers
45 views

detect and reverse malware in movie files

we suspect some media files *.avi, *.mp4 contains trojan and virus. I have tried MBAM v1.75, but it doesn't have the capability to extract the malcious files. is there any other freeware or software ...
5
votes
1answer
92 views

How can you explore behavior in malware that is not being performed?

I have a malware sample that I know is acting as a bot and connects to a botnet. The problem is that it uses no known protocol that I am familiar with (it's IRC-like) and doesn't actually do anything ...
1
vote
1answer
169 views

What location is this and what does it signify - “d:\w7rtm\minkernel\ntdll\ldrinit.c” [duplicate]

Came across this while debugging a exe. Cant find much on it anywhere so thought I'll put it up here. Any ideas as to what this could be used for? CPU Disasm Address Hex dump Command ...
5
votes
3answers
151 views

Finding a malware object inside PE file

Today my AV found an antique piece of malware called Win9X.CIH.dam. Instead of just removing it I would like to make a little research for fun. What does "data0513" exactly mean? I can't understand ...
1
vote
0answers
44 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
0
votes
1answer
49 views

Identifying code that accesses encrypted overlay in PE

I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the ...
1
vote
1answer
287 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
1
vote
0answers
142 views

ELF .text infection test

I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
0
votes
0answers
453 views

IDA Pro 7.0 can't recognize my own FLIRT signatures?

I just generated my own IDA Flirt signatures from a specific linux library, using pelf and sigmake tools, for example: ./pelf library.a library.pat ./sigmake library.pat library.sig then copied ...
-2
votes
2answers
285 views

How can I export only the mnemonics from objdump (or any other program)?

I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this? In other words of this output of objdump (objdump -d ...
0
votes
2answers
756 views

Dumping dll out of process

So there is executable malware, what when opened downloads dll from server or so and injects into target process. I checked properties of the target process in process hacker and clicked on .NET ...
1
vote
1answer
100 views

De-obfuscation - Emulation-oriented vs Script-oriented

What are the advantages of each method when employing de-obsfucation of potentially malicious code? I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
1
vote
2answers
80 views

Test malware files in host machine?

To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly. I want to know how to test malware files with out ...
4
votes
4answers
6k views

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
1
vote
1answer
109 views

Rootkit.Fileless.MTGen Reverse Engineering

Has anyone tried seeing what's inside of this malware? It ended up on one of our work machines. I copied the files to a thumb drive before setting the machine up for reimaging. Though the AV software ...
1
vote
1answer
148 views

Which RE tool is missing?

I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not. My problem is, that all the filenames and ClassNames are ...
-1
votes
1answer
151 views

Whether samples downloaded from virus share can execute automatically in my computer

I am doing some android malware analysis work and downloaded many android samples in virus share, but I found some of them are windows malware e.g. labeled 'win32' or something. Are these windows ...
0
votes
1answer
125 views

ELF64 Reflective Loading [closed]

I'm looking for an ELF64 reflective loader, so I can download an ELF and execute it without saving to disk? Is anyone able to point me at one please? Or a clear one for ELF32 so I can translate? ...
0
votes
1answer
133 views

Pyemu - cannot use PEPyEmu() module, Python

I want to run code from Gray Hat Python book for upx_unpacker. I have downloaded PyEmu, but when I run script I got this error: AttributeError: PEPyEmu instance has no attribute 'load' My script use ...
-2
votes
1answer
74 views

Malware static rules? [closed]

Is there any sites to get static rules to detect malware files? static behavior rules for detecting malware files. Thanks in advance.
0
votes
1answer
88 views

Configuring a C&C for a RAT [closed]

Where would I start when needing to configure a command and control server for a RAT? So that my dynamic analysis can be more complete. Note: I have been to the topics section of this stack exchange....
0
votes
2answers
63 views

Composition of a Binary File trouble [closed]

I am working with some malware samples and I need to determine if one of them is primarily composed of 32-bit Intel Code. This would seem easy as I can just check the metadata describing it as a 32-...
0
votes
2answers
876 views

How to unpack and decrypt malware? [duplicate]

Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
2
votes
0answers
644 views

Unable to unpack heavly obfuscated malware

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted. I tried all possible tools that I found ...
4
votes
2answers
182 views

Analysing malware in a real environment (non-virtual environment)

I have analysed malware previously using Cuckoo Sandbox, however, I've seen that some malware won't run as they detect they are actually running in a virtual environment (they implement some anti-...
0
votes
1answer
162 views

2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]

So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
0
votes
1answer
121 views

I'm would like to view this malicious payload, but am having trouble decoding it

This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this? H4sIAAAAAAAAAL1X6W6jyBb+...
3
votes
1answer
359 views

Resolve Addresses To Function Names

I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
1
vote
1answer
112 views

What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?

I was looking at the paper: "Improved Detection for Advanced Polymorphic Malware" by James Fraley who claimed to have used static, dynamic and file properties for increased malware detection. But is ...
5
votes
2answers
463 views

Reversing Self-Modifying Malware

recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
1
vote
0answers
712 views

Attaching to Dalvik static function using Frida in order to disable emulator detection

I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get ...
0
votes
1answer
766 views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
2
votes
1answer
144 views

How to detect overlay data in RTF files?

How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
0
votes
1answer
155 views

Getting Xrefs to Windows Library Functions in IDA Pro

Ok so let's say that a program obfuscated its IAT and i can't see it in IDA Pro. In OllyDbg there is a plugin where you press Ctrl+G you can search for a library function and set a breakpoint even ...
2
votes
2answers
482 views

Packed PE file and weird Header

I'm new to reverse engineering, so I don't know if my question will be easy or not. Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings : 000003d0: 0055 5058 ...
4
votes
1answer
1k views

How tools like PEiD find out the compiler and its version.

How tools like PEiD and CFF explorer find out the compiler and its version. I am analyzing a executable file. Which shows: Borland Delphi 3.0 But the section names .text .rsrc. Which is usually ...
0
votes
2answers
388 views

Manual unpacking petya ransom [closed]

I want to manually unpack red Petya ransomware. I used Ollydbg for unpacking and set breakpoint on VirtualAlloc to see the "MZ" header in memory dump, and saved it to a file. But the saved file is not ...
0
votes
2answers
879 views

How can I export only the opcodes from objdump (or any other program)

I have multiple malware files, I want to do an analysis with the opcodes. Im able to export everything to text but I only need the middle column. Any idea on how can I solve this? In other words of ...
0
votes
1answer
112 views

Information about packers

i was trying to search for some information about packers just to learn more about it, there is a lot of stuff out there but its hard to find something that really explain that good and clear, I would ...