Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Filter by
Sorted by
Tagged with
2
votes
1answer
327 views

What is Executable Compression? [closed]

I don't know whether this is the right place for this question or this question is too basic. I was reading Antivirus Hacker's Handbook, where they talked a bit about software packers, protectors, ...
11
votes
1answer
744 views

Randomly picking up a x86 register for an instruction

I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction Which i don't understand how this ...
1
vote
0answers
55 views

Reverse Engineer an iOS MP4 Bug [duplicate]

Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
1
vote
1answer
2k views

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
0
votes
1answer
574 views

Restoring an Infected appending virus EXE file by

I'm trying to restore a file that was infected by a virus (gaelicum or tenga) It's an appending virus. This is the warning I get when opening it in OllyDbg : --------------------------- Entry Point ...
1
vote
1answer
124 views

Is this request mask algorithm reversible?

I am trying to understand an algorithm from a malware I found. This algorithm encodes http request to C&C. The decompiled version is taken from IDA. There are some comments I wrote. The problem ...
0
votes
2answers
411 views

How to download Linksys firmware from router

A co-worker gave me his mom's Linksys router that he is convinced has been hacked to include a MitM. We could just upgrade the firmware, but that wouldn't be any fun and so I thought this might be a ...
4
votes
1answer
198 views

Where can I, as an individual, find clean programs to analyze?

This question includes a good list of sources where an individual might collect malware samples for analysis. I'd like to get a large number of public, non-malicious programs for the purpose of ...
0
votes
1answer
139 views

Unknown algorithm in forloop

i am reversing a malware sample .but getting stucked in a loop below.the line written in the bold letter generated random letter like "/2","/lm32" etc to EDX.The thing is that ECX does not contains ...
2
votes
1answer
323 views

Why is otkloadr.WRAssembly.1 reference present in a office file?

I was working with a RTF file and I found the string "otkloadr.WRAssembly.1" present inside the file in plain sight. I know that many exploits use this for loading the msvcr71.dll (non-ASLR module). ...
2
votes
2answers
841 views

Unable To break TLS callback function using ollydbg

while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put "System entry breakpoint" as in ollydbg Event option.Binary breaks as system breakpoint ...
2
votes
1answer
901 views

Dump a child process created by malware with an ALTERNATIVE process hollowing process

I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , ...
0
votes
1answer
484 views

Malware samples to analyze with existing disassembly?

Hopefully this question isn't get marked as Duplicate, since it differs from the following question: Where can I, as an individual, get malware samples to analyze? I'm looking for samples (ideally ...
2
votes
1answer
229 views

Distribution of malware obfuscation types

There are several statistics and numbers out there of current malware families and their distributions. However, I'am looking for statistics which shows the distribution of malware differed by their ...
1
vote
2answers
174 views

Obfuscation by changing the order of a malware behaviour

I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used. However, is there a similar technique that changes ...
0
votes
1answer
232 views

What is the relationship between the Windows API and the C run time library? [closed]

I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.) ...
0
votes
1answer
278 views

Entry point of malicious child process

OK...I have a file which, upon execution, runs a copy of itself as a child process, with, obviously, different behaviors. Since this (obviously) means that OllyDBG isn't going to be able to see what ...
1
vote
1answer
790 views

How to search sequence of API call using IDA Pro?

I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
1
vote
1answer
682 views

How to get Arg in Ollydbg

I am In A deep Trouble. I am New to Reverse Engineering. I am Currently Using OLLYDBG. Now, I was Trying to Crack the Password of a .exe file using Ollydbg Now, The EXE file which i was trying to ...
3
votes
2answers
421 views

Crash after exe modification [closed]

I am testing a malware that built as COM EXE service. This exe file had a digital signature. I succeeded to remove the digital signature for trying to modify it for reverse engineering tests. But ...
2
votes
0answers
127 views

Does anybody knows a good dataset for malware families? [duplicate]

Does anybody knows a good dataset for malware families? What i need is a dataset where malware are already classified in families. And is not duplicate of "Where can I, as an individual, get malware ...
-1
votes
1answer
284 views

how can one cause heap memory buffer overflow in a worker process by using a specially crafted request? [closed]

i am to web applications so i have recently published my website and ran a penetration test using Acunetix Vulnerability scanner so i have found the following result and for me to experience a lot ...
0
votes
1answer
1k views

where i can get android malware samples to analyze? [duplicate]

Is there any sites to get new android malware files(.apk files) for analysing purpose? and also suggest me some blogs/sites for android malware analysis? Please reply me ASAP. Thanks in advance.
2
votes
8answers
2k views

Is MD5 hashing of files a valid method of creating an anti-virus program?

Is it a good way to create Virus signature in MD5 or it is better in SHA1 or SHA256 and why it is?
2
votes
0answers
167 views

Collecting malware samples [duplicate]

Could you please list some sites from where I could download viruses/worms/trojans in .exe format. I have read the answers to the other similar questions but couldn't make much use of them. I am a ...
1
vote
1answer
66 views

How to get Waledac and Storm P2P botnets [duplicate]

I am going to conduct a research on p2p botnet detection based on their network behavior. Would you help me how to get these botnets sample. Thanx!
1
vote
0answers
51 views

Get DLL from EXE file [duplicate]

I am trying to reverse engineer an DLL that is loaded from a EXE. I don't have the DLL file. I just have an executable file that injects the DLL into a certain process. When I try using ollydbg or ...
2
votes
1answer
1k views

How do malware steal Code signing certificates?

While analyzing/studying/RE exe's/dll's you see the certificates in peview/hexeditor etc. but how does one come to know that the certificate is a fake/malicious/expired one, there has to be a ...
-1
votes
1answer
593 views

Extracting Opcodes of a binary

I want to extract opcodes 'Assembly instructions' from malware binaries . and because I have large number of samples I don't want to do it invidiously .. instead I want to automate the process of ...
1
vote
0answers
483 views

SysTracer by SysReveal.com clean?

SysTracer from SysReveal.com (not from www.blueproject.ro) seems to be a very nice tool for live monitoring your system and check what executable files do at your system. I saw some videos on YouTube ...
2
votes
2answers
306 views

Dynamic analysis of malware samples

I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample. However, I am afraid such activity ...
3
votes
2answers
2k views

Reversing a Windows service

I am trying to reverse engineer a malware that open a windows service dynamically in OllyDbg. When the malware calls StartServiceCtrDispatcherW, I receive an error: How I can continue to analyze ...
0
votes
1answer
816 views

RANSOMWARE SCRIPT decryption

I have a friend with PC which is infected with some sort of "RANSOMWARE" - a type of malware where will encrypt your files(images,videos and documents) and ask for payment for decryption. I managed ...
1
vote
3answers
281 views

What is the average time for “defusing” malware self-protection mechanisms?

I always wondered how much time is needed to get rid of all that anti-VM/crypto/protector/anti-debug stuff (without analyzing actual payload and purpose), especially if you're dealing with malware on ...
6
votes
2answers
670 views

Reverse Engineering Chinese laser engraver

I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is ...
-2
votes
1answer
576 views

How rootkits hide services on kernel mode? [closed]

How rootkits hide services on kernel mode? thanks
0
votes
1answer
61 views

Why is there no MFCxx.dll in the import table?

I have an exe which I'm confident uses MFC(I have seen the code and it heavily uses MFC) but when I see the Import Table why don't I see MFCxx.dll entry...
0
votes
1answer
614 views

open source static or dynamic malware unpacker

I am looking for static and dynamic unpacker tools. I only found PE-Explorer the only can handle UPX packer. So I am carious to know is there any open source static or dynamic unpacker?
2
votes
1answer
399 views

Hidden code in dissasembly

I'm testing malware that built from single EXE file and it doesn't load any other DLLs. I can see that EXE is register as COM object (I don't know how EXE can be COM object...). But when I run it and ...
1
vote
0answers
50 views

Where can I get a dataset of URLs of websites that diffuse malware? [duplicate]

In order to study some malware detection algorithms I am developping in my PhD, I would like to know where I could download a list of malware websites. Thank you
2
votes
1answer
189 views

Documentation of malware reverse engineering

I'm interesting in reversing malware. The problem is, that if you analyse malware on your own you don't know how efficient you are, and with which techniques/tools/methods you can use for better ...
2
votes
0answers
202 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
2
votes
2answers
882 views

How can I extend a memory of an analysed executable in IDA Pro?

I'm analysing some malware executable with ImmDBG and IDA Pro. The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides ...
0
votes
2answers
718 views

Is it dangerous to disassemble malware in IDA?

If I were to disassemble a malware sample in IDA without being in a VM, is there any way I can infect my machine?
1
vote
3answers
298 views

What is the average time for malware analysis?

I was wondering what is the average time for you to classify (by reverse engineering) if a suspicious file is a malware or not? Thanks
0
votes
1answer
181 views

Reverse engineer malware embedded in Microsoft rtf

I am currently trying to analyse a particular document that was flagged as malware in our honey pot. In virus total is shows up as being a Trojan and I have reason to believe it might be connected to ...
2
votes
2answers
1k views

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
3
votes
1answer
1k views

Unable to dump a process

I'm trying to reverse a malware sample with the following MD5: ef668a0cd0755c67930ece13d28a6bda. Obvious, this is a packed malware. On a first look, it seems to bee some GUI Programm, but at some ...
-1
votes
1answer
146 views

What certifications do I need to become a Malware Analyst? [closed]

I've previously posted here on how to get started as a malware analyst, and wanted to say thanks on getting me started. How much do certifications help me in for my resume and which one(s) should I ...
2
votes
2answers
4k views

Where can I get Linux malware samples?

There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...