Questions tagged [malware]
Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.
47
questions with no upvoted or accepted answers
4
votes
0
answers
83
views
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging ...
- 41
4
votes
0
answers
111
views
How to analyze EFI dynamically?
I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver.
I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
- 163
4
votes
0
answers
10k
views
Reversing Pyarmor Discussion
Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
- 51
3
votes
0
answers
72
views
Is there a Capturebat alternative on windows 10 for file capture?
I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit.
I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
- 31
3
votes
0
answers
277
views
Malware analysis - AntiDebugging - Malware slows down the PC while being debugged
As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution:
Being executed
Decrypt a lot of data from memory and obtain a new PE (from memory)
Create a child ...
- 668
3
votes
1
answer
256
views
Reverse Engineering Dynamic Malware Imports?
How is it possible to reverse engineer dynamic malware imports using a debugger like x32dbg or Ollydbg?
I want to dump process injection malware using a debugger trick using a breakpoint on write ...
- 105
2
votes
0
answers
40
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 131
2
votes
0
answers
133
views
In IDA freeware, how to create a new database in IDC and load a file into it?
I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder.
What ...
2
votes
0
answers
127
views
How can i Lifting x86_64 assembly code to LLVM-IR
I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting ...
- 21
2
votes
0
answers
72
views
Reverse engineering of Process manager apk
Is there someone helps me to understand how to build the server of this apk https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/ ? I tried to disassemble the apk but it is ...
- 37
2
votes
0
answers
46
views
How to get the APIs present in a particular block in a CFG using Angr?
I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
- 39
2
votes
0
answers
116
views
CFT challenge with Trojan malware?
I am trying to solve a CTF challenge with levels with escalating difficulty.
At this point, the program (PE32 executable) is detected as malware (wacatac to be more precise) by Windows Defender. It ...
2
votes
0
answers
262
views
Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment
I'm working on a sample that contains packing and anti-analysis measures.
Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
- 103
2
votes
1
answer
1k
views
How to mark data as pointer to external functions in ghidra
I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
- 21
2
votes
0
answers
98
views
API Hiding Issue
I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
- 21
2
votes
0
answers
174
views
Determine what architecture a piece of shellcode targets
After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
- 121
1
vote
0
answers
33
views
Yara Rules 4.3 Warnings
$hex = {CC CC CC CC CC CC CC CC}
Warning : "$hex" may slow down scanning
Do anyone know how to remove this warning
- 31
1
vote
0
answers
164
views
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to solve this?
I have seen sandbox reports in those the ...
- 31
1
vote
0
answers
569
views
Decompiling a Node.js application compiled with nexe
Someone have sent a Discord token stealer and out of curiosity, I would like to decompile it, just to get some info about the attacker.
Judging by folders created in my user directory, multiple ...
- 11
1
vote
0
answers
43
views
Capturing created and deleted files from a Java file
I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
1
vote
0
answers
127
views
Best way from high level software developer to malware analyst
I am a software developer with commercial experience in Python and mainly Scala working on high level programming, e.g. REST APIs, and only personal/university projects experience in C++.
I would like ...
1
vote
0
answers
106
views
Ways of creating a new thread on Windows
I'd like to know about every possible way how a thread can be created in a process at the lowest possible level.
There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
- 121
1
vote
0
answers
53
views
How are AutoIT variable names stored after compiling it to a executable?
I need to write a yara rule for a autoit malware (the binary itself not the decompiled script)
As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
- 232
1
vote
0
answers
69
views
How does this wannacry sample work?
I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive.
I figured out how most of the binary works, except the very last ...
- 55
1
vote
0
answers
286
views
Reverse Engineering Android ROMS to detect malicious code
I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm ...
- 51
1
vote
0
answers
243
views
Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used
I want to reverse a stripped x86 sample that uses a static library.
So far I could identify the library itself and narrow the version of the library used.
Now I want to use Ghidra's Function ID ...
- 11
1
vote
0
answers
271
views
How can I extract resource images from Visual Basic 6 Malware
I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I ...
- 773
1
vote
0
answers
138
views
Decompiling DotNet2JScript malware?
I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
- 11
1
vote
0
answers
472
views
ELF .text infection test
I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
- 11
1
vote
0
answers
2k
views
Attaching to Dalvik static function using Frida in order to disable emulator detection
I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get ...
- 11
1
vote
0
answers
372
views
What do malicious programs use the ESENT registry key for?
I was analyzing a piece of malware and noticed it created this registry key.
hkey_local_machine\software\microsoft\ esent\process{malware file name}\debug
Some googling told me that esent is just a ...
- 11
1
vote
0
answers
75
views
Where can I get a good description about windows build-in exe programs like wupdmgr.exe?
I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe.
Is there any "msdn" alike repository but for exe ...
- 125
1
vote
0
answers
796
views
SysTracer by SysReveal.com clean?
SysTracer from SysReveal.com (not from www.blueproject.ro) seems to be a very nice tool for live monitoring your system and check what executable files do at your system. I saw some videos on YouTube ...
- 111
1
vote
0
answers
310
views
Is there any technique called "DLL Replacement"?
I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) ...
- 11
1
vote
1
answer
1k
views
How to get Arg in Ollydbg
I am In A deep Trouble. I am New to Reverse Engineering. I am Currently Using OLLYDBG. Now, I was Trying to Crack the Password of a .exe file using Ollydbg
Now, The EXE file which i was trying to ...
- 29
1
vote
2
answers
159
views
Identifying file-access functions used by explorer.exe
I'm trying to write a Windows 10 64-bit rootkit that runs on userland and hides files using IAT hooking. I managed to accomplish that on cmd.exe by hooking FindFirstFileW and FindNextFileW imported ...
0
votes
0
answers
62
views
Why is Windows 10 still blocking me from running malware?
I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
- 131
0
votes
0
answers
222
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 519
0
votes
0
answers
132
views
Malware analysis of undetected NodeJS token grabber
I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'.
Someone contacted me asking to playtest a game, which prompted a .exe file.
I ran the file and website on ...
0
votes
0
answers
213
views
new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?
just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0
answers
42
views
Jumping to a specific logation for DLL injection : OllyDbg
Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates:
Can I call a jmp function ...
- 1
0
votes
0
answers
599
views
IDAPython - Find the start of an undefined code blob
I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing.
I'm in a case where some portions of my code contain this type of anti-...
- 709
0
votes
0
answers
101
views
idapython - Scan all possible code paths between start and end addresses
I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
- 103
0
votes
0
answers
126
views
What is the name of this technique?
A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual ...
- 111
0
votes
0
answers
466
views
Does malware ever purposely embed resources to thwart resource analysis and extraction
I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
- 233
0
votes
1
answer
284
views
2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]
So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
-2
votes
1
answer
1k
views
Aside from Assembly, should I learn C or C++?
With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
