Questions tagged [malware]
Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.
326
questions
0
votes
2
answers
557
views
cdecl calling convention
Hello best people, my question is this example is telling me about cdecl calling convention. I have confusion that when analyzing the code in disassembly how would I recognize that this is the cdecl ...
- 323
5
votes
3
answers
2k
views
Is Null in Windows equal to zero?
(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
1
vote
1
answer
3k
views
Mul(Multiplication) in x64 and in x32 assembly
I'm completely new in malware reverse engineering. I'm stuck in a confusion that,
I studied that in x32, mul instruction multiplies the source with eax register and store the result as 64 bit value ...
- 323
1
vote
1
answer
931
views
Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?
I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly ...
- 111
1
vote
1
answer
515
views
Does the operating system you use matter?
people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
- 13
1
vote
1
answer
479
views
what is Off in IDA Pro?
probably silly question, what does Off ... means in IDA Pro?
i markered the snapshot as an example.
1
vote
2
answers
2k
views
How can I de-obfuscate a VBScript (.vbs) file?
I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
- 151
-1
votes
2
answers
221
views
Ransomware Source Codes [closed]
Have been searching ransomware source codes for analysis(as much as possible). I have already checked with sites like Any.Run but most of their samples are .exe and binary files. Does any one have any ...
2
votes
1
answer
755
views
Disassemble and debug dynamic generated code executed via delegate in c#
I'm trying to reverse engeneer a malware using dnSpy that at some point do this:
delegate IntPtr H7IREAEBYY(string path, IntPtr data);
byte[] array = new byte[]
{ 233, 151, ... }
IntPtr value ...
- 21
2
votes
1
answer
112
views
Structure of operand bytes in .NET call and data access IL instructions?
I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions
for example based on experience, the last byte of API/...
- 519
1
vote
0
answers
106
views
Ways of creating a new thread on Windows
I'd like to know about every possible way how a thread can be created in a process at the lowest possible level.
There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
- 121
6
votes
1
answer
2k
views
Why does PE ImageBase address change in memory?
I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
- 61
0
votes
2
answers
199
views
How does an executable’s static API differ from it’s dynamic API?
Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
- 27
1
vote
0
answers
53
views
How are AutoIT variable names stored after compiling it to a executable?
I need to write a yara rule for a autoit malware (the binary itself not the decompiled script)
As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
- 232
1
vote
1
answer
2k
views
How to know where a sequences of bytes are used in a .NET application with Dnspy?
There are a sequence of bytes that i need to find out where are used in dnspy
i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
- 232
0
votes
1
answer
191
views
Debugging Encrypted Malware with Multiple Threads
What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
- 3
-2
votes
1
answer
236
views
How to reverse engineer apks? [closed]
is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
- 309
-1
votes
1
answer
123
views
Force debug Administrator Malware
I want to analyse a malware that do not run without administrative previliges.
I know it is risky but still.
How can I debug it with debugger as from entry point?
Because debugger could not start ...
2
votes
1
answer
185
views
Code based Yara rule
I have to write a Yara rules for malwares that is based on assember code. Suppose I have an unpacked malware sample. To avoid false positives, the selected code must be unique. Can anyone tell me ...
- 21
4
votes
0
answers
10k
views
Reversing Pyarmor Discussion
Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
- 51
0
votes
2
answers
904
views
Is there any way to write a IDA script that finds constant values used in all functions, no matter the instruction?
So lets say i have these type of instructions in functions :
x == constant value
x = constant value
x > constant value
no matter if its just an assignment or compare or anything, i want to get the ...
- 176
0
votes
1
answer
143
views
Malware attempting to move a value into $zero in MIPS?
Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times.
addiu $zero, 0xA
as well as move $at, $at
...
1
vote
2
answers
4k
views
What does objdump -b binary means?
So I have started to digging in malware analysis and I came across with some malware samples that I couldn't disassembly with objdump. More specifically I use
objdump -dS /path/to/malware
and I got ...
- 23
0
votes
3
answers
275
views
What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?
What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
- 519
0
votes
3
answers
870
views
How To Identify Which Process Is Being Written To With WriteProcessMemory?
Basically, I cannot find which process is being written to when WriteProcessMemory is being called.
Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
- 11
0
votes
1
answer
127
views
Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?
So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
- 519
1
vote
1
answer
130
views
Android dynamic UI state inspection/profiling tool
I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio https://developer.android.com/studio/debug/layout-inspector.
Is ...
- 121
2
votes
1
answer
88
views
How to “unprotect” malicious workbook without knowing password
Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
- 173
0
votes
1
answer
43
views
Linux encryption/luks/pymouth password scripts corruption
I noticed that the bootup scripts that collect the password for full disk encryption on linux (fedora-31) were displaying corrupted text. The kind that looked like binary data being printed at text:
...
- 11
0
votes
1
answer
431
views
Obfuscated VBE malware script analysis
Some actions of this script are clear e.g. the section that adds firewall rules, others not so much
On Error Resume Next
F27
F10
A0
DBCF
Sub F27()
Dim E13C563AFCB34, C0009B48F34B, C8, ...
- 121
1
vote
0
answers
69
views
How does this wannacry sample work?
I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive.
I figured out how most of the binary works, except the very last ...
- 55
3
votes
1
answer
334
views
CreateTimerQueueTimer arguments differs from WinAPI
I was reading a man page about CreateTimerQueueTimer.
BOOL CreateTimerQueueTimer(
PHANDLE phNewTimer,
HANDLE TimerQueue,
WAITORTIMERCALLBACK Callback,
PVOID ...
- 281
2
votes
2
answers
1k
views
Fileless malware samples
If file-based malware sample can be downloaded from sites such as theZoo aka Malware DB or any sites as suggested here, what about fileless malware as it doesn't store it's copy in the hard disk?
If ...
- 121
1
vote
2
answers
2k
views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
- 61
2
votes
0
answers
98
views
API Hiding Issue
I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
- 21
1
vote
3
answers
706
views
What is the difference between malware that is 'dumped' and one that is 'unpacked'?
On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
- 233
0
votes
1
answer
157
views
What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?
Sorry if this is a stupid question but couldnt find the answer by googling
Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
- 232
0
votes
2
answers
208
views
Tools for detecting packing and encryption
I'm doing a cert in malware analysis and I'm looking for some up to date tools to automate detection of packing and encryption to aid the reversing process.
I've found TitanMist however it seems ...
0
votes
2
answers
101
views
How to Calculate ds Pointer
How do I calculate the location of the string in this sample located at offset 0x1CAD8?
The instruction at 0x140001A97 in the sample is:
0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
- 136
2
votes
2
answers
171
views
Malware Samples that defeats emulators by using uncommon API calls [closed]
I am looking for a few malware samples that detects sandboxes using uncommon API calls. I understand that one of the drawbacks of OS emulated sandboxes is that the malware can use uncommon API calls ...
- 21
2
votes
1
answer
267
views
Unable to properly analyze a very simple C-compiled program
I'm a RE beginner and I decided to start writing my own simple code for practice.
I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
- 21
2
votes
1
answer
213
views
Recognize a decryption algorithm
I'm trying to reverse a malware that builds its IAT at runtime. Due to my inexperience, I'm having trouble to understand this function that accepts into EAX a dword (maybe some sort of hash) and into ...
- 439
1
vote
1
answer
190
views
Difficulty obtaining malware traffic
I'm trying to get a particular piece of malware to beacon, and I have my box connected to remnux, with inetsim and fakedns running. Using this setup I have been able to acquire good pcap from most ...
- 173
2
votes
1
answer
362
views
How to hide a process from all the methods of getting the list of processes?
So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not
so these are the ways i know :
...
- 519
-1
votes
1
answer
133
views
malware analysis [closed]
I tried to use process monitor to find out what program 4.exe did on my system. However, I could not find what changes were made.
I believe that this program modifies some files and the registry, but ...
- 1
2
votes
1
answer
781
views
Start vs WinMain()
I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
- 141
0
votes
0
answers
599
views
IDAPython - Find the start of an undefined code blob
I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing.
I'm in a case where some portions of my code contain this type of anti-...
- 709
1
vote
3
answers
3k
views
Cyber security student wanting to start learning reverse engineering [duplicate]
I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated
What should I learn before I start to learn reverse engineering?
Is learning C/...
- 13
1
vote
0
answers
286
views
Reverse Engineering Android ROMS to detect malicious code
I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm ...
- 51
1
vote
0
answers
243
views
Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used
I want to reverse a stripped x86 sample that uses a static library.
So far I could identify the library itself and narrow the version of the library used.
Now I want to use Ghidra's Function ID ...
- 11