Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Filter by
Sorted by
Tagged with
127 votes
14 answers
125k views

Where can I, as an individual, get malware samples to analyze?

It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users. The bottleneck here for people aspiring to break ...
72 votes
9 answers
81k views

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
64 votes
4 answers
5k views

How can I analyze a potentially harmful binary safely?

I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
  • 1,425
19 votes
4 answers
7k views

How common are virtualized packers in the wild?

I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
  • 403
17 votes
3 answers
14k views

Which IDA Pro Signature should be used for Borland Delphi 6.0-7.0 binaries as reported in PEiD?

I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using ...
  • 181
15 votes
4 answers
6k views

INT 2D Anti-Forensic Method

Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
  • 253
15 votes
1 answer
3k views

Malware Hooking INT 1 and INT 3

I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
  • 3,866
14 votes
4 answers
4k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
  • 143
14 votes
5 answers
3k views

How to capture an "in-memory" malware in MS-Windows?

I have an infected MS-Windows 7 machine with an in-memory malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some ...
  • 18.1k
14 votes
3 answers
3k views

How do AV vendors create signatures for polymorphic viruses?

I was working on a hobby AV project using ClamAV's engine. While ClamAV is a good open source engine, it has poor support for detecting polymorphic viruses. The latest updated version failed to detect ...
  • 655
14 votes
3 answers
21k views

Difference between DllMain and DllEntryPoint

I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following: Run it with ...
  • 471
13 votes
2 answers
11k views

What are the different types of packers?

I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved. Yet, it seems that ...
  • 18.1k
12 votes
5 answers
2k views

Malware in virtual machines

Once I perform static analysis on a malware sample, I next run it in a virtual machine. Does this give the malware a chance to spread to the real machine? Does this give the malware a chance to ...
  • 417
11 votes
3 answers
2k views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
11 votes
1 answer
842 views

Randomly picking up a x86 register for an instruction

I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction Which i don't understand how this ...
  • 314
9 votes
2 answers
2k views

Is there an easy way to detect if the SSDT has been patched from a memory dump?

The SSDT is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain ...
  • 1,212
9 votes
3 answers
1k views

How to get virus body of Polymorphic Malware

I want to decrypt polymorphic malware and want to get actual virus body which is going to do infection. I tried to decrypt virut.ce (this is one polymorphic malware) in ollyDbg but it is using anti ...
9 votes
2 answers
7k views

What are the differences between metamorphic, oligomorphic and polymorphic malware?

Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, ...
  • 18.1k
9 votes
1 answer
3k views

How to handle exceptions in a debugger when reversing malware?

I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When ...
  • 1,407
8 votes
1 answer
5k views

How tools like PEiD find out the compiler and its version.

How tools like PEiD and CFF explorer find out the compiler and its version. I am analyzing a executable file. Which shows: Borland Delphi 3.0 But the section names .text .rsrc. Which is usually ...
8 votes
2 answers
1k views

Automated Static Unpacking Binaries

I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
7 votes
2 answers
24k views

What happens when a DLL is added to AppInit_DLL

I have a malware sample that adds a DLL to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs. There is malicious functionality in the DLL referenced by the ...
  • 1,246
7 votes
3 answers
529 views

Academic journals for latest RE/Malware/Exploitation research?

I am looking for journals to keep track of the latest advances in reverse engineering, binary analysis, malware, binary exploitation, etc.
7 votes
2 answers
1k views

FEEDFACE in OSX malware

I was reverse engineering a piece of code in "Crisis" for fun and I encountered the following :- __INIT_STUB_hidden:00004B8F mov eax, 8FE00000h __INIT_STUB_hidden:00004B94 ...
user avatar
7 votes
2 answers
2k views

Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE

As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and last 1024) in some type of custom CFB XOR encryption. I ...
6 votes
4 answers
2k views

Program with no dependencies

while reading the answers to Can I statically link (not import) the Windows system DLLs? I came up with another question. So: Is there a way to write a program that has no dependencies (nothing is ...
  • 2,862
6 votes
4 answers
714 views

How antiviruses name malwares

While analyzing a binary online through the virustotal service , I found out that different AVs named the binaries differently.For instance, for that same binary Norman named it Obfuscated_A, ...
  • 734
6 votes
2 answers
667 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
6 votes
3 answers
2k views

What is this obfuscation method called?

I have recently seen the following code obfuscation method: ... jump loc_1234 ;------------------------- Bunch of junk ;------------------------- loc_1234: code continued... The logic ...
  • 2,958
6 votes
1 answer
972 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
  • 61
6 votes
2 answers
932 views

Decompiling .NET marshaled code

There's a .NET malware sample I'm trying to analyze, which goes more or less like this: internal static class Class1 { public static byte[] Code = new byte[] { 9, 249, ...
6 votes
2 answers
955 views

What PE anomalies can crash the Windows Loader or cause a file to not load?

I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I ...
  • 1,625
6 votes
2 answers
868 views

Reverse Engineering Chinese laser engraver

I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is ...
  • 63
5 votes
3 answers
2k views

Is Null in Windows equal to zero?

(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
5 votes
2 answers
3k views

how to reverse DeviceIoControl?

I have started reversing this piece of malware. At some point it creates a service and starts it, then immediately it calls the function DeviceIoControl and the malware went from "paused" to "running" ...
5 votes
3 answers
4k views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
5 votes
3 answers
3k views

How to break on not-yet-loaded kernel driver

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
  • 403
5 votes
2 answers
6k views

How to unpack files packed with multiple packers?

As I am just getting started in RE, I've mostly faced files packed with a single-layer of packing , such as UPX, ASPack, etc. Unpacking these protections is fully documented online. The problem ...
  • 417
5 votes
3 answers
768 views

Is there any websites to get malware files using YARA rules?

I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules? Note: I know some websites to get android malware samples using YARA. But, I need Windows ...
  • 121
5 votes
2 answers
2k views

Need advice : Reverse engineering a pdf with shellcode

Problem : I try to find the plaintext which was hidden at pdf inbuilt with shellcode What i tried : I received a pdf which contains javascript with it ,i dig the pdf as follows : Exploring ...
5 votes
1 answer
242 views

Strange GDB behavior in OSX

I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...
user avatar
5 votes
3 answers
3k views

Where can I find benign samples with a high potential to false positive?

In the pursuit and development of malware detection algorithms, often a big sample set of both malicious and benign samples is required. Both machine learning or similar automated techniques, as well ...
  • 11.4k
5 votes
1 answer
2k views

Intro to reverse engineering [closed]

I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in ...
  • 93
5 votes
2 answers
363 views

How can we determine that malware are related?

I am curious to know about how researchers can know when different malware are related. for example: Stuxnet, Flame or Duqu, are told to be written by the same group. Does anyone know how they figure ...
5 votes
2 answers
735 views

Safe way to download a malware payload?

I'm trying to analyze a piece of malware that is most-likely a downloader. During dynamic analysis on an isolated VM network, Wireshark registered a GET request to a server for what I believe is the ...
  • 163
5 votes
3 answers
216 views

Finding a malware object inside PE file

Today my AV found an antique piece of malware called Win9X.CIH.dam. Instead of just removing it I would like to make a little research for fun. What does "data0513" exactly mean? I can't understand ...
5 votes
1 answer
2k views

How to create a virus signature from decompiled source

I have a problem where I have to create a virus signature for the Stoned Virus (Although this could apply to any virus/file). Let's assume I have a copy of the compiled and decompiled program. I then ...
5 votes
1 answer
113 views

How can you explore behavior in malware that is not being performed?

I have a malware sample that I know is acting as a bot and connects to a botnet. The problem is that it uses no known protocol that I am familiar with (it's IRC-like) and doesn't actually do anything ...
  • 51
5 votes
1 answer
214 views

Where can I, as an individual, find clean programs to analyze?

This question includes a good list of sources where an individual might collect malware samples for analysis. I'd like to get a large number of public, non-malicious programs for the purpose of ...
  • 159
4 votes
4 answers
19k views

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...

1
2 3 4 5
7