Questions tagged [malware]
Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.
37
questions
132
votes
14
answers
126k
views
Where can I, as an individual, get malware samples to analyze?
It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users.
The bottleneck here for people aspiring to break ...
76
votes
9
answers
85k
views
Analyzing highly obfuscated JavaScript
I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
- 963
66
votes
4
answers
5k
views
How can I analyze a potentially harmful binary safely?
I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
- 1,475
5
votes
1
answer
2k
views
Intro to reverse engineering [closed]
I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in ...
- 93
15
votes
4
answers
4k
views
Debugging malware that will only run as a service
I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
- 153
15
votes
2
answers
12k
views
What are the different types of packers?
I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved.
Yet, it seems that ...
- 18.9k
2
votes
3
answers
7k
views
Where can I get Linux malware samples?
There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
- 117
15
votes
3
answers
22k
views
Difference between DllMain and DllEntryPoint
I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following:
Run it with ...
- 491
12
votes
3
answers
2k
views
Why is JMP used with CALL?
I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter>
I am not an expert in Assembly. I know that CALL ...
5
votes
2
answers
474
views
Why does an executable give an error when opened in $tool?
I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
- 325
3
votes
1
answer
580
views
How can I determine if a piece of code is an encryption algorithm?
I am trying to reverse engineer a malware, and came across a piece of code that I suspect is an encryption/decryption procedure, however I do not know for sure. I can recognize that it extracts its ...
- 155
0
votes
1
answer
118
views
Malware application in Android
Is there some website that give us the possibility to download malware APK in order to study it? I’m interested to study the abuse of android.permission.RECORD_AUDIO in Android 8.
- 37
20
votes
4
answers
7k
views
How common are virtualized packers in the wild?
I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
- 413
16
votes
4
answers
7k
views
INT 2D Anti-Forensic Method
Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
- 263
14
votes
5
answers
3k
views
How to capture an "in-memory" malware in MS-Windows?
I have an infected MS-Windows 7 machine with an in-memory malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some ...
- 18.9k
13
votes
5
answers
2k
views
Malware in virtual machines
Once I perform static analysis on a malware sample, I next run it in a virtual machine.
Does this give the malware a chance to spread to the real machine?
Does this give the malware a chance to ...
- 437
10
votes
2
answers
2k
views
Is there an easy way to detect if the SSDT has been patched from a memory dump?
The SSDT is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain ...
- 1,252
9
votes
2
answers
7k
views
What are the differences between metamorphic, oligomorphic and polymorphic malware?
Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, ...
- 18.9k
8
votes
1
answer
5k
views
How tools like PEiD find out the compiler and its version.
How tools like PEiD and CFF explorer find out the compiler and its version.
I am analyzing a executable file. Which shows: Borland Delphi 3.0
But the section names .text .rsrc. Which is usually ...
- 81
7
votes
2
answers
2k
views
Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE
As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and last 1024) in some type of custom CFB XOR encryption. I ...
- 113
5
votes
3
answers
4k
views
Where can I find benign samples with a high potential to false positive?
In the pursuit and development of malware detection algorithms, often a big sample set of both malicious and benign samples is required. Both machine learning or similar automated techniques, as well ...
- 11.7k
5
votes
3
answers
338
views
Tool for checking if there is any patch in the loaded module
I'm looking for a tool that is able to check loaded module for any placed patches even on not exported functions.
I'm aware of Gmer, RKU and Co. and frankly I don't really trust their results.
- 3,002
5
votes
3
answers
4k
views
Is learning assembly enough to become a malware analyst? [closed]
I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst.
I know it is not enough to just know how to read assembly to become a ...
- 927
4
votes
2
answers
327
views
Analysing malware in a real environment (non-virtual environment)
I have analysed malware previously using Cuckoo Sandbox, however, I've seen that some malware won't run as they detect they are actually running in a virtual environment (they implement some anti-...
- 187
4
votes
2
answers
3k
views
Reversing a Windows service
I am trying to reverse engineer a malware that open a windows service dynamically in OllyDbg.
When the malware calls StartServiceCtrDispatcherW, I receive an error:
How I can continue to analyze ...
- 43
3
votes
1
answer
1k
views
Good foundation for reverse engineering malware
I have been intrigued by reverse engineering recently and just finished Paul Carter's PC Assembly Language book (http://pacman128.github.io/static/pcasm-book.pdf) which was a great primer for x86. My ...
- 187
3
votes
3
answers
4k
views
Detecting packed 64-bit Windows Portable Executable (EXE) files
What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files).
I am not interested in the packer used I would just like to know if the file is packed or ...
- 51
3
votes
1
answer
5k
views
Unable to dump malware assembly using objdump
I'm trying to dump assembly code of a ShellShock malware explained in this blog post:
MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... .
After dumping using objdump -...
3
votes
1
answer
1k
views
Dump a child process created by malware with an ALTERNATIVE process hollowing process
I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , ...
- 31
2
votes
2
answers
2k
views
Generating call graph for assembly instructions
I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
- 171
1
vote
1
answer
137
views
Problem with analyzing malware
We have a malware that blocks all analytics software in real time.
This software has blacklisted a large list of software that performs analysis (x64dbg, ida, serialport monitor, etc.)
This software ...
- 31
1
vote
3
answers
7k
views
How can I export only the opcodes from objdump (or any other program)
I have multiple malware files, I want to do an analysis with the opcodes. Im able to export everything to text but I only need the middle column. Any idea on how can I solve this?
In other words of ...
1
vote
3
answers
726
views
Most efficient way to begin analyzing malware binary
I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
- 135
0
votes
0
answers
599
views
IDAPython - Find the start of an undefined code blob
I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing.
I'm in a case where some portions of my code contain this type of anti-...
- 709
0
votes
3
answers
275
views
What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?
What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
- 519
-2
votes
1
answer
907
views
How do anti-virus programs catch a virus? How they detect it? [closed]
I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?
- 73
-3
votes
2
answers
3k
views
Anti-debug techniques for MS-Windows?
Is there any anti-debugger tricks used by malware other than interrupt INT 0x2D ? And, how do they work ? Working examples would be really nice !
- 135