Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Filter by
Sorted by
Tagged with
1
vote
1answer
57 views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
1
vote
0answers
20 views

How are AutoIT variable names stored after compiling it to a executable?

I need to write a yara rule for a autoit malware (the binary itself not the decompiled script) As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
0
votes
1answer
64 views

Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?

So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
0
votes
1answer
48 views

Debugging Encrypted Malware with Multiple Threads

What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
-1
votes
0answers
25 views

RE tips in using Ollydbg for beginners? [closed]

I am new to the RE community and currently studying debugging. I still have no clue how to start the debugging process when given a virus or infected file. Do you have any tips for beginners on ...
-1
votes
1answer
48 views

Force debug Administrator Malware

I want to analyse a malware that do not run without administrative previliges. I know it is risky but still. How can I debug it with debugger as from entry point? Because debugger could not start ...
-3
votes
1answer
99 views

How to reverse engineer apks? [closed]

is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
14
votes
3answers
17k views

Difference between DllMain and DllEntryPoint

I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following: Run it with ...
2
votes
1answer
1k views

Unable to unpack heavly obfuscated malware

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted. I tried all possible tools that I found ...
1
vote
1answer
59 views

Code based Yara rule

I have to write a Yara rules for malwares that is based on assember code. Suppose I have an unpacked malware sample. To avoid false positives, the selected code must be unique. Can anyone tell me ...
0
votes
0answers
127 views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
0
votes
3answers
84 views

What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?

What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
0
votes
3answers
124 views

How To Identify Which Process Is Being Written To With WriteProcessMemory?

Basically, I cannot find which process is being written to when WriteProcessMemory is being called. Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
0
votes
0answers
24 views

How to view all of the struct member values in IDA pro?

The problem i am having in reading the struct values is that in the decompiler, when the struct is too large i cant view all the values when i hover over the structure member : Tried viewing these ...
0
votes
1answer
138 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
5
votes
3answers
2k views

What is this obfuscation method called?

I have recently seen the following code obfuscation method: ... jump loc_1234 ;------------------------- Bunch of junk ;------------------------- loc_1234: code continued... The logic ...
0
votes
2answers
61 views

Is there any way to write a IDA script that finds constant values used in all functions, no matter the instruction?

So lets say i have these type of instructions in functions : x == constant value x = constant value x > constant value no matter if its just an assignment or compare or anything, i want to get the ...
0
votes
0answers
32 views

Is there any tool that finds common things like strings among large number of binaries?

So this is really needed in malware analysis, for example if i have 1000 samples from a family and i want to know which strings are common among all of them, it would really help to have a tool that ...
1
vote
1answer
30 views

Android dynamic UI state inspection/profiling tool

I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector. Is ...
0
votes
1answer
69 views

Malware attempting to move a value into $zero in MIPS?

Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times. addiu $zero, 0xA as well as move $at, $at ...
1
vote
2answers
74 views

What does objdump -b binary means?

So I have started to digging in malware analysis and I came across with some malware samples that I couldn't disassembly with objdump. More specifically I use objdump -dS /path/to/malware and I got ...
2
votes
1answer
3k views

Unable to dump malware assembly using objdump

I'm trying to dump assembly code of a ShellShock malware explained in this blog post: MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... . After dumping using objdump -...
0
votes
0answers
17 views

Passing file through inetsim

I have a piece of malware that downloads a config file from a google drive link, and I want to determine how the config file is used and where it beacons to without running the file connected to the ...
2
votes
1answer
67 views

How to “unprotect” malicious workbook without knowing password

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
0
votes
1answer
28 views

Linux encryption/luks/pymouth password scripts corruption

I noticed that the bootup scripts that collect the password for full disk encryption on linux (fedora-31) were displaying corrupted text. The kind that looked like binary data being printed at text: ...
0
votes
1answer
181 views

Obfuscated VBE malware script analysis

Some actions of this script are clear e.g. the section that adds firewall rules, others not so much On Error Resume Next F27 F10 A0 DBCF Sub F27() Dim E13C563AFCB34, C0009B48F34B, C8, ...
1
vote
0answers
39 views

How does this wannacry sample work?

I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive. I figured out how most of the binary works, except the very last ...
2
votes
1answer
132 views

Fileless malware samples

If file-based malware sample can be downloaded from sites such as theZoo aka Malware DB or any sites as suggested here, what about fileless malware as it doesn't store it's copy in the hard disk? If ...
3
votes
1answer
116 views

CreateTimerQueueTimer arguments differs from WinAPI

I was reading a man page about CreateTimerQueueTimer. BOOL CreateTimerQueueTimer( PHANDLE phNewTimer, HANDLE TimerQueue, WAITORTIMERCALLBACK Callback, PVOID ...
1
vote
2answers
539 views

Why Windows Defender is not able to get rid of this trojan?

Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
1
vote
0answers
73 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
1
vote
3answers
157 views

What is the difference between malware that is 'dumped' and one that is 'unpacked'?

On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
0
votes
1answer
53 views

What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?

Sorry if this is a stupid question but couldnt find the answer by googling Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
0
votes
2answers
94 views

Tools for detecting packing and encryption

I'm doing a cert in malware analysis and I'm looking for some up to date tools to automate detection of packing and encryption to aid the reversing process. I've found TitanMist however it seems ...
2
votes
1answer
141 views

Unable to properly analyze a very simple C-compiled program

I'm a RE beginner and I decided to start writing my own simple code for practice. I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
0
votes
2answers
63 views

How to Calculate ds Pointer

How do I calculate the location of the string in this sample located at offset 0x1CAD8? The instruction at 0x140001A97 in the sample is: 0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
2
votes
2answers
111 views

Malware Samples that defeats emulators by using uncommon API calls [closed]

I am looking for a few malware samples that detects sandboxes using uncommon API calls. I understand that one of the drawbacks of OS emulated sandboxes is that the malware can use uncommon API calls ...
2
votes
1answer
108 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
8
votes
2answers
991 views

Automated Static Unpacking Binaries

I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
2
votes
1answer
175 views

Recognize a decryption algorithm

I'm trying to reverse a malware that builds its IAT at runtime. Due to my inexperience, I'm having trouble to understand this function that accepts into EAX a dword (maybe some sort of hash) and into ...
1
vote
1answer
83 views

Difficulty obtaining malware traffic

I'm trying to get a particular piece of malware to beacon, and I have my box connected to remnux, with inetsim and fakedns running. Using this setup I have been able to acquire good pcap from most ...
-1
votes
1answer
77 views

malware analysis [closed]

I tried to use process monitor to find out what program 4.exe did on my system. However, I could not find what changes were made. I believe that this program modifies some files and the registry, but ...
2
votes
1answer
227 views

Start vs WinMain()

I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
1
vote
3answers
3k views

How can I export only the opcodes from objdump (or any other program)

I have multiple malware files, I want to do an analysis with the opcodes. Im able to export everything to text but I only need the middle column. Any idea on how can I solve this? In other words of ...
0
votes
0answers
169 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
1
vote
3answers
704 views

Cyber security student wanting to start learning reverse engineering [duplicate]

I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated What should I learn before I start to learn reverse engineering? Is learning C/...
68
votes
9answers
69k views

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
1
vote
0answers
102 views

Reverse Engineering Android ROMS to detect malicious code

I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm ...
1
vote
0answers
71 views

Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used

I want to reverse a stripped x86 sample that uses a static library. So far I could identify the library itself and narrow the version of the library used. Now I want to use Ghidra's Function ID ...
2
votes
0answers
67 views

Determine what architecture a piece of shellcode targets

After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...

1
2 3 4 5 6