Skip to main content

Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

48 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
118 views

API Breakpoints not hitting while debugging a malware using x32dbg

I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful. I am going through a malware analysis course and following the debugging ...
Daksh Kapur's user avatar
4 votes
0 answers
126 views

How to analyze EFI dynamically?

I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver. I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
Raafat's user avatar
  • 163
4 votes
0 answers
10k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
Jimmy Hankey's user avatar
3 votes
0 answers
96 views

Is there a Capturebat alternative on windows 10 for file capture?

I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit. I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
dakar111's user avatar
3 votes
0 answers
277 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
0xAK's user avatar
  • 668
3 votes
1 answer
295 views

Reverse Engineering Dynamic Malware Imports?

How is it possible to reverse engineer dynamic malware imports using a debugger like x32dbg or Ollydbg? I want to dump process injection malware using a debugger trick using a breakpoint on write ...
David L. Wilson's user avatar
2 votes
0 answers
56 views

WinDbg Preview search is not returning results

I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
Jason Crosby's user avatar
2 votes
0 answers
215 views

In IDA freeware, how to create a new database in IDC and load a file into it?

I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder. What ...
IDAIDCMalAnalysis's user avatar
2 votes
0 answers
176 views

How can i Lifting x86_64 assembly code to LLVM-IR

I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting ...
OSPFv3's user avatar
  • 21
2 votes
0 answers
74 views

Reverse engineering of Process manager apk

Is there someone helps me to understand how to build the server of this apk https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/ ? I tried to disassemble the apk but it is ...
Gregor's user avatar
  • 37
2 votes
0 answers
47 views

How to get the APIs present in a particular block in a CFG using Angr?

I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
okokok hack's user avatar
2 votes
0 answers
132 views

CFT challenge with Trojan malware?

I am trying to solve a CTF challenge with levels with escalating difficulty. At this point, the program (PE32 executable) is detected as malware (wacatac to be more precise) by Windows Defender. It ...
Horia Pantelimon's user avatar
2 votes
0 answers
278 views

Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment

I'm working on a sample that contains packing and anti-analysis measures. Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
user3238415's user avatar
2 votes
0 answers
109 views

Ways of creating a new thread on Windows

I'd like to know about every possible way how a thread can be created in a process at the lowest possible level. There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
original.roland's user avatar
2 votes
0 answers
101 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
badbabo's user avatar
  • 21
2 votes
0 answers
183 views

Determine what architecture a piece of shellcode targets

After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
game0ver's user avatar
  • 121
1 vote
0 answers
75 views

trying to understand how Redboot ransomware works

this sample is able to drop exes though I'm not sure how the report indicates it calls CreateFileW though changing the call's outcome doesn't work is Redboot using heaven's gate (or another technique) ...
ALsec's user avatar
  • 11
1 vote
0 answers
36 views

Yara Rules 4.3 Warnings

$hex = {CC CC CC CC CC CC CC CC} Warning : "$hex" may slow down scanning Do anyone know how to remove this warning
Satyam Singh's user avatar
1 vote
0 answers
274 views

IDA pro Error how to resolve this error

52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672) How to solve this? I have seen sandbox reports in those the ...
Satyam Singh's user avatar
1 vote
0 answers
637 views

Decompiling a Node.js application compiled with nexe

Someone have sent a Discord token stealer and out of curiosity, I would like to decompile it, just to get some info about the attacker. Judging by folders created in my user directory, multiple ...
nolemretaW's user avatar
1 vote
0 answers
43 views

Capturing created and deleted files from a Java file

I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
Tyler Edmonds's user avatar
1 vote
0 answers
131 views

Best way from high level software developer to malware analyst

I am a software developer with commercial experience in Python and mainly Scala working on high level programming, e.g. REST APIs, and only personal/university projects experience in C++. I would like ...
Giulia Ippoliti's user avatar
1 vote
0 answers
57 views

How are AutoIT variable names stored after compiling it to a executable?

I need to write a yara rule for a autoit malware (the binary itself not the decompiled script) As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
Mery Ted's user avatar
  • 232
1 vote
0 answers
78 views

How does this wannacry sample work?

I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive. I figured out how most of the binary works, except the very last ...
M. Kalter's user avatar
1 vote
0 answers
298 views

Reverse Engineering Android ROMS to detect malicious code

I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm ...
Sparval's user avatar
  • 51
1 vote
0 answers
271 views

Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used

I want to reverse a stripped x86 sample that uses a static library. So far I could identify the library itself and narrow the version of the library used. Now I want to use Ghidra's Function ID ...
Ghidra's user avatar
  • 11
1 vote
0 answers
289 views

How can I extract resource images from Visual Basic 6 Malware

I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I ...
LUser's user avatar
  • 793
1 vote
0 answers
139 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
Leff Ivanov's user avatar
1 vote
0 answers
487 views

ELF .text infection test

I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
Andrew's user avatar
  • 11
1 vote
0 answers
2k views

Attaching to Dalvik static function using Frida in order to disable emulator detection

I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get ...
Disane's user avatar
  • 11
1 vote
0 answers
387 views

What do malicious programs use the ESENT registry key for?

I was analyzing a piece of malware and noticed it created this registry key. hkey_local_machine\software\microsoft\ esent\process{malware file name}\debug Some googling told me that esent is just a ...
Carson 's user avatar
1 vote
0 answers
75 views

Where can I get a good description about windows build-in exe programs like wupdmgr.exe?

I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe. Is there any "msdn" alike repository but for exe ...
Ahmad Kouraiem's user avatar
1 vote
0 answers
824 views

SysTracer by SysReveal.com clean?

SysTracer from SysReveal.com (not from www.blueproject.ro) seems to be a very nice tool for live monitoring your system and check what executable files do at your system. I saw some videos on YouTube ...
John Doof's user avatar
  • 111
1 vote
0 answers
317 views

Is there any technique called "DLL Replacement"?

I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) ...
aoe's user avatar
  • 11
1 vote
1 answer
1k views

How to get Arg in Ollydbg

I am In A deep Trouble. I am New to Reverse Engineering. I am Currently Using OLLYDBG. Now, I was Trying to Crack the Password of a .exe file using Ollydbg Now, The EXE file which i was trying to ...
Yada Rahal's user avatar
1 vote
2 answers
240 views

Identifying file-access functions used by explorer.exe

I'm trying to write a Windows 10 64-bit rootkit that runs on userland and hides files using IAT hooking. I managed to accomplish that on cmd.exe by hooking FindFirstFileW and FindNextFileW imported ...
one_hell_of_a_guy's user avatar
0 votes
0 answers
37 views

Is it possible to hide androidmanifest.xml

I heard from someone today that androidmanifest.xml is hidden by new malware. I couldn't find anything about this on the internet. Is it possible?
mustafa günel's user avatar
0 votes
0 answers
70 views

Why is Windows 10 still blocking me from running malware?

I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
Jason Crosby's user avatar
0 votes
0 answers
270 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
OneAndOnly's user avatar
0 votes
0 answers
179 views

Malware analysis of undetected NodeJS token grabber

I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'. Someone contacted me asking to playtest a game, which prompted a .exe file. I ran the file and website on ...
Louis Vanhove's user avatar
0 votes
0 answers
262 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
ringXzero's user avatar
0 votes
0 answers
45 views

Jumping to a specific logation for DLL injection : OllyDbg

Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates: Can I call a jmp function ...
muhammad's user avatar
0 votes
0 answers
665 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
Guillaume's user avatar
  • 709
0 votes
0 answers
111 views

idapython - Scan all possible code paths between start and end addresses

I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
user3238415's user avatar
0 votes
0 answers
128 views

What is the name of this technique?

A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual ...
Ulrik's user avatar
  • 111
0 votes
0 answers
467 views

Does malware ever purposely embed resources to thwart resource analysis and extraction

I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
Fred Concklin's user avatar
0 votes
1 answer
291 views

2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]

So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
peterlagunas's user avatar
-2 votes
1 answer
2k views

Aside from Assembly, should I learn C or C++?

With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
FormosaTBM's user avatar