Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

28 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
2answers
934 views

Automated Static Unpacking Binaries

I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
2
votes
2answers
85 views

Malware Samples that defeats emulators by using uncommon API calls

I am looking for a few malware samples that detects sandboxes using uncommon API calls. I understand that one of the drawbacks of OS emulated sandboxes is that the malware can use uncommon API calls ...
2
votes
0answers
861 views

Unable to unpack heavly obfuscated malware

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted. I tried all possible tools that I found ...
2
votes
0answers
585 views

What conditions can create the “Not a Valid Win32 Application” error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
2
votes
0answers
203 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
1
vote
0answers
42 views

Reverse Engineering Android ROMS to detect malicious code

I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm ...
1
vote
0answers
44 views

Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used

I want to reverse a stripped x86 sample that uses a static library. So far I could identify the library itself and narrow the version of the library used. Now I want to use Ghidra's Function ID ...
1
vote
0answers
53 views

Determine what architecture a piece of shellcode targets

After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
1
vote
0answers
77 views

How can I extract resource images from Visual Basic 6 Malware

I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I ...
1
vote
0answers
70 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
1
vote
0answers
221 views

ELF .text infection test

I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
1
vote
0answers
1k views

Attaching to Dalvik static function using Frida in order to disable emulator detection

I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get ...
1
vote
0answers
227 views

What do malicious programs use the ESENT registry key for?

I was analyzing a piece of malware and noticed it created this registry key. hkey_local_machine\software\microsoft\ esent\process{malware file name}\debug Some googling told me that esent is just a ...
1
vote
0answers
71 views

Where can I get a good description about windows build-in exe programs like wupdmgr.exe?

I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe. Is there any "msdn" alike repository but for exe ...
1
vote
0answers
114 views

What is the name of this technique?

A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual ...
1
vote
0answers
502 views

SysTracer by SysReveal.com clean?

SysTracer from SysReveal.com (not from www.blueproject.ro) seems to be a very nice tool for live monitoring your system and check what executable files do at your system. I saw some videos on YouTube ...
1
vote
0answers
213 views

Analysis target modifies debugging registers during initial file open in ollydbg

While opening a binary in Ollydbg, I get a warning that the debugged program has modified the debugging registers. The following entry is in the log: Address: 7749218E Modified debug registers of main ...
1
vote
1answer
709 views

How to get Arg in Ollydbg

I am In A deep Trouble. I am New to Reverse Engineering. I am Currently Using OLLYDBG. Now, I was Trying to Crack the Password of a .exe file using Ollydbg Now, The EXE file which i was trying to ...
0
votes
0answers
58 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
0
votes
0answers
82 views

Reverse engineering .NET malware - iloveyou.exe

I have a .NET malware sample whose dynamic behavior I understand. It is also packed. de4dot identified the obfuscator as .NET Reactor, so I used de4dot to de-obfuscate it. However, after de-...
0
votes
0answers
52 views

idapython - Scan all possible code paths between start and end addresses

I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
0
votes
1answer
106 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
0answers
36 views

Replacing a function call with it's result in a script

I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function. The problem is that this ...
0
votes
0answers
439 views

Does malware ever purposely embed resources to thwart resource analysis and extraction

I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
0
votes
0answers
263 views

Is there any technique called “DLL Replacement”?

I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) ...
0
votes
1answer
198 views

2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]

So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
-1
votes
1answer
258 views

Whether samples downloaded from virus share can execute automatically in my computer

I am doing some android malware analysis work and downloaded many android samples in virus share, but I found some of them are windows malware e.g. labeled 'win32' or something. Are these windows ...
-1
votes
1answer
611 views

Aside from Assembly, should I learn C or C++?

With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...