Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Filter by
Sorted by
Tagged with
3
votes
1answer
426 views

How can I determine if a piece of code is an encryption algorithm?

I am trying to reverse engineer a malware, and came across a piece of code that I suspect is an encryption/decryption procedure, however I do not know for sure. I can recognize that it extracts its ...
2
votes
2answers
182 views

VBA code detection in MS office documents

So, lately I've been working on a project involving malware which gets spread via MS Office documents and, among other things, I need to detect the VBA code in appropriate document streams. I've read ...
4
votes
2answers
619 views

What PE anomalies can crash the Windows Loader or cause a file to not load?

I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I ...
1
vote
1answer
150 views

Likely malicous Javascript-interested in how it works

Got this interesting bit of code compressed in an email named "Install-MSOffice365-WebView-Plugin-Update-0.165.11a.exe.js" that is undoubtedly malicous, but was curious what it does and am not much of ...
1
vote
0answers
71 views

Where can I get a good description about windows build-in exe programs like wupdmgr.exe?

I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe. Is there any "msdn" alike repository but for exe ...
-1
votes
1answer
678 views

Aside from Assembly, should I learn C or C++?

With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
1
vote
2answers
1k views

Anti-VM and anti-sandbox malware samples

I'm learning malware analysis. I'm looking for malware samples that terminate themselves when recognize working on a VM or sandbox. Thanks.
3
votes
3answers
3k views

Detecting packed 64-bit Windows Portable Executable (EXE) files

What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files). I am not interested in the packer used I would just like to know if the file is packed or ...
0
votes
1answer
126 views

What is the relation between binary (executable) instructions and execution instruction [closed]

What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ? In other world, in area of malware analysis a binary ...
1
vote
0answers
115 views

What is the name of this technique?

A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual ...
2
votes
1answer
435 views

DGA(Domain Generation Algorithm) based malware files

Where i can get DGA (Domain Generation Algorithm) based malware files for analysis? And,Can I get malware family names which is using Domain Generation Algorithm?
2
votes
1answer
992 views

how to overcome setunhandledexceptionfilter in ollyDebugger?

I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this. Can you guys please explain the setunhandledexceptionfilter() anti-...
-2
votes
1answer
92 views

Need help in understanding the code of a “Malicious” file [closed]

I'm testing a malware sample : hxxps://www.virustotal.com/en/file/55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd/analysis/ This is a malicious executable file. When executed in ...
5
votes
2answers
493 views

Safe way to download a malware payload?

I'm trying to analyze a piece of malware that is most-likely a downloader. During dynamic analysis on an isolated VM network, Wireshark registered a GET request to a server for what I believe is the ...
3
votes
2answers
1k views

How to debug malware that injects itself into another process?

I am kind of new in the field of reverse engineering, so sorry if it is a silly question. I have to analyse some malwares for my bachelor thesis and I am currently trying to reverse engineer a ...
0
votes
2answers
599 views

sandbox for analyzing network traffic

I am in search of looking an open source sandbox that has the following features: - route my network traffic to the sandbox for analysis - perform analysis on network traffic to detect malicious ...
1
vote
1answer
117 views

IDA pro can not resolved section after unpacking procedure

I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as DD. Is this sample still packed ...
0
votes
1answer
84 views

Where can I get systematic problems and solutions for debugging?

I know PEFile headers, assembly language, and other basic stuff. I am looking for some site or book which systematically teaches me debugging and reversing. Something like "Let us C" for C language. ...
0
votes
1answer
797 views

Can't debug a service

I am working on Lab11-03 in "Practical Malware Analysis" book. The malware I am analyzing trojanized the file cisvc.exe which is the indexing service in Windows XP. After that the malware start the ...
7
votes
2answers
2k views

Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE

As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and last 1024) in some type of custom CFB XOR encryption. I ...
2
votes
1answer
379 views

What is Executable Compression? [closed]

I don't know whether this is the right place for this question or this question is too basic. I was reading Antivirus Hacker's Handbook, where they talked a bit about software packers, protectors, ...
11
votes
1answer
761 views

Randomly picking up a x86 register for an instruction

I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction Which i don't understand how this ...
1
vote
0answers
56 views

Reverse Engineer an iOS MP4 Bug [duplicate]

Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
1
vote
1answer
2k views

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
0
votes
1answer
636 views

Restoring an Infected appending virus EXE file by

I'm trying to restore a file that was infected by a virus (gaelicum or tenga) It's an appending virus. This is the warning I get when opening it in OllyDbg : --------------------------- Entry Point ...
1
vote
1answer
124 views

Is this request mask algorithm reversible?

I am trying to understand an algorithm from a malware I found. This algorithm encodes http request to C&C. The decompiled version is taken from IDA. There are some comments I wrote. The problem ...
0
votes
2answers
466 views

How to download Linksys firmware from router

A co-worker gave me his mom's Linksys router that he is convinced has been hacked to include a MitM. We could just upgrade the firmware, but that wouldn't be any fun and so I thought this might be a ...
4
votes
1answer
198 views

Where can I, as an individual, find clean programs to analyze?

This question includes a good list of sources where an individual might collect malware samples for analysis. I'd like to get a large number of public, non-malicious programs for the purpose of ...
0
votes
1answer
142 views

Unknown algorithm in forloop

i am reversing a malware sample .but getting stucked in a loop below.the line written in the bold letter generated random letter like "/2","/lm32" etc to EDX.The thing is that ECX does not contains ...
2
votes
1answer
337 views

Why is otkloadr.WRAssembly.1 reference present in a office file?

I was working with a RTF file and I found the string "otkloadr.WRAssembly.1" present inside the file in plain sight. I know that many exploits use this for loading the msvcr71.dll (non-ASLR module). ...
2
votes
2answers
973 views

Unable To break TLS callback function using ollydbg

while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put "System entry breakpoint" as in ollydbg Event option.Binary breaks as system breakpoint ...
2
votes
1answer
948 views

Dump a child process created by malware with an ALTERNATIVE process hollowing process

I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , ...
0
votes
1answer
526 views

Malware samples to analyze with existing disassembly?

Hopefully this question isn't get marked as Duplicate, since it differs from the following question: Where can I, as an individual, get malware samples to analyze? I'm looking for samples (ideally ...
2
votes
1answer
233 views

Distribution of malware obfuscation types

There are several statistics and numbers out there of current malware families and their distributions. However, I'am looking for statistics which shows the distribution of malware differed by their ...
1
vote
2answers
177 views

Obfuscation by changing the order of a malware behaviour

I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used. However, is there a similar technique that changes ...
0
votes
1answer
236 views

What is the relationship between the Windows API and the C run time library? [closed]

I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.) ...
0
votes
1answer
299 views

Entry point of malicious child process

OK...I have a file which, upon execution, runs a copy of itself as a child process, with, obviously, different behaviors. Since this (obviously) means that OllyDBG isn't going to be able to see what ...
1
vote
1answer
899 views

How to search sequence of API call using IDA Pro?

I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
1
vote
1answer
774 views

How to get Arg in Ollydbg

I am In A deep Trouble. I am New to Reverse Engineering. I am Currently Using OLLYDBG. Now, I was Trying to Crack the Password of a .exe file using Ollydbg Now, The EXE file which i was trying to ...
3
votes
2answers
474 views

Crash after exe modification [closed]

I am testing a malware that built as COM EXE service. This exe file had a digital signature. I succeeded to remove the digital signature for trying to modify it for reverse engineering tests. But ...
2
votes
0answers
131 views

Does anybody knows a good dataset for malware families? [duplicate]

Does anybody knows a good dataset for malware families? What i need is a dataset where malware are already classified in families. And is not duplicate of "Where can I, as an individual, get malware ...
-1
votes
1answer
294 views

how can one cause heap memory buffer overflow in a worker process by using a specially crafted request? [closed]

i am to web applications so i have recently published my website and ran a penetration test using Acunetix Vulnerability scanner so i have found the following result and for me to experience a lot ...
0
votes
1answer
1k views

where i can get android malware samples to analyze? [duplicate]

Is there any sites to get new android malware files(.apk files) for analysing purpose? and also suggest me some blogs/sites for android malware analysis? Please reply me ASAP. Thanks in advance.
2
votes
8answers
2k views

Is MD5 hashing of files a valid method of creating an anti-virus program?

Is it a good way to create Virus signature in MD5 or it is better in SHA1 or SHA256 and why it is?
2
votes
0answers
170 views

Collecting malware samples [duplicate]

Could you please list some sites from where I could download viruses/worms/trojans in .exe format. I have read the answers to the other similar questions but couldn't make much use of them. I am a ...
1
vote
1answer
68 views

How to get Waledac and Storm P2P botnets [duplicate]

I am going to conduct a research on p2p botnet detection based on their network behavior. Would you help me how to get these botnets sample. Thanx!
1
vote
0answers
110 views

Get DLL from EXE file [duplicate]

I am trying to reverse engineer an DLL that is loaded from a EXE. I don't have the DLL file. I just have an executable file that injects the DLL into a certain process. When I try using ollydbg or ...
2
votes
1answer
1k views

How do malware steal Code signing certificates?

While analyzing/studying/RE exe's/dll's you see the certificates in peview/hexeditor etc. but how does one come to know that the certificate is a fake/malicious/expired one, there has to be a ...
-1
votes
1answer
679 views

Extracting Opcodes of a binary

I want to extract opcodes 'Assembly instructions' from malware binaries . and because I have large number of samples I don't want to do it invidiously .. instead I want to automate the process of ...
1
vote
0answers
592 views

SysTracer by SysReveal.com clean?

SysTracer from SysReveal.com (not from www.blueproject.ro) seems to be a very nice tool for live monitoring your system and check what executable files do at your system. I saw some videos on YouTube ...