Questions tagged [malware]
Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.
326
questions
132
votes
14
answers
126k
views
Where can I, as an individual, get malware samples to analyze?
It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users.
The bottleneck here for people aspiring to break ...
76
votes
9
answers
85k
views
Analyzing highly obfuscated JavaScript
I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
- 963
66
votes
4
answers
5k
views
How can I analyze a potentially harmful binary safely?
I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
- 1,475
20
votes
4
answers
7k
views
How common are virtualized packers in the wild?
I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
- 413
18
votes
3
answers
15k
views
Which IDA Pro Signature should be used for Borland Delphi 6.0-7.0 binaries as reported in PEiD?
I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using ...
- 191
16
votes
4
answers
7k
views
INT 2D Anti-Forensic Method
Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
- 263
16
votes
1
answer
3k
views
Malware Hooking INT 1 and INT 3
I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
- 4,056
15
votes
4
answers
4k
views
Debugging malware that will only run as a service
I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
- 153
15
votes
3
answers
3k
views
How do AV vendors create signatures for polymorphic viruses?
I was working on a hobby AV project using ClamAV's engine. While ClamAV is a good open source engine, it has poor support for detecting polymorphic viruses. The latest updated version failed to detect ...
- 685
15
votes
2
answers
12k
views
What are the different types of packers?
I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved.
Yet, it seems that ...
- 18.9k
15
votes
3
answers
22k
views
Difference between DllMain and DllEntryPoint
I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following:
Run it with ...
- 491
14
votes
5
answers
3k
views
How to capture an "in-memory" malware in MS-Windows?
I have an infected MS-Windows 7 machine with an in-memory malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some ...
- 18.9k
13
votes
5
answers
2k
views
Malware in virtual machines
Once I perform static analysis on a malware sample, I next run it in a virtual machine.
Does this give the malware a chance to spread to the real machine?
Does this give the malware a chance to ...
- 437
12
votes
3
answers
2k
views
Why is JMP used with CALL?
I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter>
I am not an expert in Assembly. I know that CALL ...
11
votes
1
answer
873
views
Randomly picking up a x86 register for an instruction
I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction
Which i don't understand how this ...
- 314
10
votes
3
answers
627
views
Academic journals for latest RE/Malware/Exploitation research?
I am looking for journals to keep track of the latest advances in reverse engineering, binary analysis, malware, binary exploitation, etc.
- 131
10
votes
2
answers
2k
views
Is there an easy way to detect if the SSDT has been patched from a memory dump?
The SSDT is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain ...
- 1,252
10
votes
1
answer
3k
views
How to handle exceptions in a debugger when reversing malware?
I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When ...
- 1,527
9
votes
3
answers
1k
views
How to get virus body of Polymorphic Malware
I want to decrypt polymorphic malware and want to get actual virus body which is going to do infection. I tried to decrypt virut.ce (this is one polymorphic malware) in ollyDbg but it is using anti ...
- 161
9
votes
2
answers
7k
views
What are the differences between metamorphic, oligomorphic and polymorphic malware?
Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, ...
- 18.9k
8
votes
2
answers
25k
views
What happens when a DLL is added to AppInit_DLL
I have a malware sample that adds a DLL to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs. There is malicious functionality in the DLL referenced by the ...
- 1,326
8
votes
2
answers
2k
views
FEEDFACE in OSX malware
I was reverse engineering a piece of code in "Crisis" for fun and I encountered the following :-
__INIT_STUB_hidden:00004B8F mov eax, 8FE00000h
__INIT_STUB_hidden:00004B94
...
user1743
8
votes
1
answer
5k
views
How tools like PEiD find out the compiler and its version.
How tools like PEiD and CFF explorer find out the compiler and its version.
I am analyzing a executable file. Which shows: Borland Delphi 3.0
But the section names .text .rsrc. Which is usually ...
- 81
8
votes
2
answers
1k
views
Automated Static Unpacking Binaries
I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
- 1,410
7
votes
4
answers
2k
views
Program with no dependencies
while reading the answers to Can I statically link (not import) the Windows system DLLs? I came up with another question. So:
Is there a way to write a program that has no dependencies (nothing is ...
- 3,002
7
votes
3
answers
2k
views
What is this obfuscation method called?
I have recently seen the following code obfuscation method:
...
jump loc_1234
;-------------------------
Bunch of junk
;-------------------------
loc_1234:
code continued...
The logic ...
- 3,088
7
votes
2
answers
2k
views
Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE
As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and last 1024) in some type of custom CFB XOR encryption. I ...
- 113
6
votes
2
answers
6k
views
How to unpack files packed with multiple packers?
As I am just getting started in RE, I've mostly faced files packed with a single-layer of packing , such as UPX, ASPack, etc.
Unpacking these protections is fully documented online. The problem ...
- 437
6
votes
4
answers
721
views
How antiviruses name malwares
While analyzing a binary online through the virustotal service , I found out that different AVs named the binaries differently.For instance, for that same binary Norman named it Obfuscated_A, ...
- 784
6
votes
1
answer
250
views
Strange GDB behavior in OSX
I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...
user1743
6
votes
2
answers
703
views
Reverse engineering Perl-compatible regular-expressions
I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
- 121
6
votes
1
answer
2k
views
Why does PE ImageBase address change in memory?
I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
- 61
6
votes
2
answers
1k
views
Decompiling .NET marshaled code
There's a .NET malware sample I'm trying to analyze, which goes more or less like this:
internal static class Class1
{
public static byte[] Code = new byte[]
{
9,
249,
...
- 121
6
votes
2
answers
1k
views
What PE anomalies can crash the Windows Loader or cause a file to not load?
I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I ...
- 1,830
6
votes
2
answers
908
views
Reverse Engineering Chinese laser engraver
I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is ...
- 63
5
votes
3
answers
2k
views
Is Null in Windows equal to zero?
(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
5
votes
2
answers
4k
views
how to reverse DeviceIoControl?
I have started reversing this piece of malware. At some point it creates a service and starts it, then immediately it calls the function DeviceIoControl and the malware went from "paused" to "running" ...
- 95
5
votes
3
answers
4k
views
Is learning assembly enough to become a malware analyst? [closed]
I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst.
I know it is not enough to just know how to read assembly to become a ...
- 927
5
votes
3
answers
3k
views
How to break on not-yet-loaded kernel driver
I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
- 413
5
votes
3
answers
837
views
Is there any websites to get malware files using YARA rules?
I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules?
Note: I know some websites to get android malware samples using YARA.
But, I need Windows ...
- 121
5
votes
2
answers
2k
views
Need advice : Reverse engineering a pdf with shellcode
Problem :
I try to find the plaintext which was hidden at pdf inbuilt with shellcode
What i tried :
I received a pdf which contains javascript with it ,i dig the pdf as follows :
Exploring ...
- 1,097
5
votes
3
answers
4k
views
Where can I find benign samples with a high potential to false positive?
In the pursuit and development of malware detection algorithms, often a big sample set of both malicious and benign samples is required. Both machine learning or similar automated techniques, as well ...
- 11.7k
5
votes
1
answer
2k
views
Intro to reverse engineering [closed]
I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in ...
- 93
5
votes
2
answers
474
views
Why does an executable give an error when opened in $tool?
I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
- 325
5
votes
2
answers
367
views
How can we determine that malware are related?
I am curious to know about how researchers can know when different malware are related. for example: Stuxnet, Flame or Duqu, are told to be written by the same group. Does anyone know how they figure ...
- 51
5
votes
2
answers
848
views
Safe way to download a malware payload?
I'm trying to analyze a piece of malware that is most-likely a downloader. During dynamic analysis on an isolated VM network, Wireshark registered a GET request to a server for what I believe is the ...
- 163
5
votes
3
answers
228
views
Finding a malware object inside PE file
Today my AV found an antique piece of malware called Win9X.CIH.dam.
Instead of just removing it I would like to make a little research for fun.
What does "data0513" exactly mean? I can't understand ...
- 51
5
votes
1
answer
2k
views
Prevent malware from deleting itself during installation on Windows x64
Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection.
I've looked at CaptureBat, but its ...
- 3,002
5
votes
2
answers
4k
views
How to load a dumped process and several accompanied memory pages in IDA?
I have dumped process and several dumped pages of memory that were allocated in it. How can I load everything in IDA into one DB and reference pages in the loaded process?
- 3,002
5
votes
1
answer
1k
views
How 10 IS HEX 5 bytes?
I am stuck in this video. Please solve this issue.
This video is about Encryption and Decryption using Win32 API.
https://www.youtube.com/watch?v=OQuRwpUTBpQ
In this video 27:07 it's saying "10 ...
- 105