Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Filter by
Sorted by
Tagged with
3
votes
1answer
897 views

What conditions can create the “Not a Valid Win32 Application” error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
-1
votes
1answer
39 views

looking at some strings from malware. is this able to be decoded? / made human readable [closed]

path command-line-arguments github.com/ropnop/go-clr (devel) golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527 h1:uYVVQ9WP/Ds2ROhcaGPeIdVq0RIXVLwsHlnvJ+cT1So= golang.org/x/text v0.3.3 h1:cokOdA+...
0
votes
1answer
43 views

Analyzing a possibly malware sample

I am trying to analyze a possible malicious sample. It's a windows executable e3f04124e2e26f8f030f6845086875a9 Md5sum Intel 386 or later processors and compatible processors File 2464.exe 2464.exe: ...
1
vote
0answers
4k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
2
votes
0answers
24 views

Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment

I'm working on a sample that contains packing and anti-analysis measures. Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
0
votes
0answers
30 views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
0
votes
0answers
34 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
1
vote
1answer
754 views

I'm would like to view this malicious payload, but am having trouble decoding it

This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this? H4sIAAAAAAAAAL1X6W6jyBb+...
0
votes
2answers
116 views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
0
votes
1answer
204 views

How can I de-obfuscate a VBScript (.vbs) file?

I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
0
votes
0answers
20 views

Domain Generating Algorithm

Has anyone modified a DGA and Seed? Is it difficult? I'd like to use an existing DGA and seed, alter both in my lab, deploy malware in my lab, and test so I fully understand the inner workings of how ...
0
votes
1answer
31 views

Is there any way to STOP the loop of the IDApython?

Is there any way to STOP the loop of the IDApython ? I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
0
votes
0answers
65 views

Windbg vs x64dbg for network analysis

I have a program that I want to perform malware analysis on. The program seems to use HTTPs with SSL pinning (my theory) and some other proprietary protocol. I want to understand what is the best tool ...
0
votes
0answers
26 views

Malware sample in hybrid-analysis.com

I've been watching great SANS Instructor John Hubbard's video in YouTube and would like to try analyze similar malware sample. The second macro-enabled doc sample can be downloaded here MD5 : ...
0
votes
0answers
68 views

Analyzing a Composite Document File V2 Document MSI Installer malware

I have a malware to analyze with md5sum - 000cbfb28e750f2e321551c03e4fe488 When I run the command on linux : file {malware-file-name} it shows : Composite Document File V2 Document, Little Endian, Os: ...
0
votes
0answers
34 views

When is a wide-character function called?

I am rather new to reversing and currently I am trying to reverse and understand one of the malware samples that seem to be used by DPRK actors to target security researchers. https://norfolkinfosec....
1
vote
0answers
74 views

Best way from high level software developer to malware analyst

I am a software developer with commercial experience in Python and mainly Scala working on high level programming, e.g. REST APIs, and only personal/university projects experience in C++. I would like ...
1
vote
1answer
117 views

Disassemble and debug dynamic generated code executed via delegate in c#

I'm trying to reverse engeneer a malware using dnSpy that at some point do this: delegate IntPtr H7IREAEBYY(string path, IntPtr data); byte[] array = new byte[] { 233, 151, ... } IntPtr value ...
2
votes
1answer
1k views

Unable to unpack heavly obfuscated malware

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted. I tried all possible tools that I found ...
2
votes
1answer
174 views

The Knowledge of Compiler for becoming a good Reverser

I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
2
votes
1answer
58 views

Is there an easier way to break on a rootkit driver load, other than disassembling IopLoadDriver?

The only method i know to break on a DriverEntry of a rootkit driver when its loaded is to disassmble nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on ...
3
votes
2answers
566 views

Crash after exe modification [closed]

I am testing a malware that built as COM EXE service. This exe file has a digital signature. I succeeded to remove the digital signature for trying to modify it for reverse engineering tests. But when ...
1
vote
1answer
61 views

Using windows 10 for malware analysis

I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
0
votes
0answers
23 views

Jumping to a specific logation for DLL injection : OllyDbg

Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates: Can I call a jmp function ...
2
votes
1answer
38 views

Shannon Entropy of Individual PE sections

Why is Shannon Entropy of individual sections always between 0-8. Also why we need to create a 256 freq array while calculating the Shannon Entropy?
0
votes
2answers
73 views

cdecl calling convention

Hello best people, my question is this example is telling me about cdecl calling convention. I have confusion that when analyzing the code in disassembly how would I recognize that this is the cdecl ...
2
votes
2answers
364 views

Fileless malware samples

If file-based malware sample can be downloaded from sites such as theZoo aka Malware DB or any sites as suggested here, what about fileless malware as it doesn't store it's copy in the hard disk? If ...
5
votes
3answers
2k views

Is Null in Windows equal to zero?

(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
1
vote
1answer
345 views

Mul(Multiplication) in x64 and in x32 assembly

I'm completely new in malware reverse engineering. I'm stuck in a confusion that, I studied that in x32, mul instruction multiplies the source with eax register and store the result as 64 bit value ...
1
vote
1answer
111 views

Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?

I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
2
votes
3answers
6k views

Where can I get Linux malware samples?

There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
-2
votes
1answer
92 views

Is this an endless loop?

I saw this part of the code in practical malware analysis. This construct is a loop for sure, but there isn't any condition. Is this an endless loop?
1
vote
1answer
97 views

Does the operating system you use matter?

people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
0
votes
1answer
88 views

what is Off in IDA Pro?

probably silly question, what does Off ... means in IDA Pro? i markered the snapshot as an example.
0
votes
0answers
75 views

IDA IDC script does not seem to work

I am trying to measure code coverage for a malware sample linked here. I am using DynamoRIO's(7.1.0-1) drcov utility to get an ASCII log. The log file is linked here. I am then using Dynapstalker to ...
5
votes
3answers
424 views

Academic journals for latest RE/Malware/Exploitation research?

I am looking for journals to keep track of the latest advances in reverse engineering, binary analysis, malware, binary exploitation, etc.
-1
votes
2answers
97 views

Ransomware Source Codes [closed]

Have been searching ransomware source codes for analysis(as much as possible). I have already checked with sites like Any.Run but most of their samples are .exe and binary files. Does any one have any ...
1
vote
1answer
169 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in VirusTotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
2
votes
1answer
54 views

Structure of operand bytes in .NET call and data access IL instructions?

I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions for example based on experience, the last byte of API/...
1
vote
0answers
50 views

Ways of creating a new thread on Windows

I'd like to know about every possible way how a thread can be created in a process at the lowest possible level. There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
0
votes
0answers
173 views

Bypass anti memory dump with process hacker and dump the malware?

I have a malware that has some sort of anti dumping technique, so when i dump a region of memory with process hacker it dumps a 0 byte file, i am also running the process hacker as a unrestricted user ...
69
votes
9answers
75k views

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
5
votes
1answer
327 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
0
votes
0answers
24 views

How to check in IDApython that if a call is an API/Library call or not?

I want to check for every call instruction whether its an API call or library call (statically linked that flirt recognized) The only solution i found is this : Finding all API calls in a function but ...
0
votes
1answer
85 views

Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?

So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
0
votes
2answers
92 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
1
vote
1answer
517 views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
1
vote
0answers
39 views

How are AutoIT variable names stored after compiling it to a executable?

I need to write a yara rule for a autoit malware (the binary itself not the decompiled script) As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
0
votes
1answer
74 views

Debugging Encrypted Malware with Multiple Threads

What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
-1
votes
1answer
69 views

Force debug Administrator Malware

I want to analyse a malware that do not run without administrative previliges. I know it is risky but still. How can I debug it with debugger as from entry point? Because debugger could not start ...

1
2 3 4 5
7