Questions tagged [malware]
Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.
326
questions
2
votes
0
answers
174
views
Determine what architecture a piece of shellcode targets
After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to ...
- 121
0
votes
0
answers
101
views
idapython - Scan all possible code paths between start and end addresses
I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
- 103
1
vote
0
answers
271
views
How can I extract resource images from Visual Basic 6 Malware
I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I ...
- 773
1
vote
1
answer
3k
views
Detecting cracked Themida packed malware
I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples.
As alluring as it is to suggest just blacklisting all Themida ...
- 173
2
votes
1
answer
3k
views
Difficulty in debugging with dnSpy
I have a dotnet malware sample that I'm trying to debug with dnSpy. It has string obfuscation (contains function names such as BarriersBottomed, etc.) I cleaned the sample using de4dot and renamed ...
- 23
1
vote
1
answer
176
views
How can I know what the executable is missing to run?
I have extracted a presence of MZ file from memory which happen to be available in VirusTotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
- 11
1
vote
3
answers
720
views
Most efficient way to begin analyzing malware binary
I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
- 135
0
votes
2
answers
1k
views
What's happening in the assembly main function?
I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here.
Where should I set the breakpoints (...
- 96
0
votes
1
answer
91
views
what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify
How can these pe attributes be used to identify malware.
I was going though a paper link at page 10 he mentioned.
"BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary ...
- 103
-1
votes
2
answers
1k
views
CreateThread returns true but thread doesn't run [closed]
I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions.
The call to the CreateThread returns a valid handle ...
- 395
1
vote
2
answers
182
views
Emotet invoice, what is the embedded file inside the word document
This pastebin hosts current URLs hosting the fake invoice of Emotet malware, which is the dropper part of the malware.
The document is a Office Open XML, and there are two large non textual segments ...
- 113
0
votes
1
answer
858
views
ida pro issue debugging issues with ntdll [closed]
I am using IDA pro to follow along a youtube video of RE from OALabs. https://www.youtube.com/watch?v=kdNQhfgoQoU&t=1575s
I am facing a problem when i try to put a break point on functions in ...
- 3
10
votes
3
answers
628
views
Academic journals for latest RE/Malware/Exploitation research?
I am looking for journals to keep track of the latest advances in reverse engineering, binary analysis, malware, binary exploitation, etc.
- 131
0
votes
2
answers
597
views
capturing the sub processes's PID of a process
When a program is executed, some processes may be created by the parent process. Especially, if a program is malware, created (or forked or even injected) sub-processes will be named as a systemic ...
0
votes
1
answer
140
views
Reverse engineering Infostealer.Dyre
I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre malware sample from theZoo on GitHub and I've been trying to analyze it.
I've put up my analysis report here. ...
- 23
3
votes
2
answers
646
views
Manually unpacking DarkTequila, stumped. Can anyone help?
The malware is packed w/ UPX - can see 0/1 in sections.
Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
- 133
1
vote
1
answer
4k
views
How to convert Unexplored data in IDA Pro to code？
I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
- 11
2
votes
1
answer
397
views
General unpacking of packed malware
I did a brief survey on malware unpacking and I found several theses on automated general unpacking:Eureka, PolyUnpack, omniUnpack, Malware Normalization.
However, these theses are written years ago ...
- 21
0
votes
1
answer
250
views
Finding a specific malware sample [closed]
I am trying to find for analysis the scuinst.exe binary (R2D2 aka Bundestrojaner), but I can not find it.
Where can I find this binary?
- 11
5
votes
1
answer
114
views
How can you explore behavior in malware that is not being performed?
I have a malware sample that I know is acting as a bot and connects to a botnet. The problem is that it uses no known protocol that I am familiar with (it's IRC-like) and doesn't actually do anything ...
- 51
3
votes
1
answer
2k
views
What location is this and what does it signify - "d:\w7rtm\minkernel\ntdll\ldrinit.c" [duplicate]
Came across this while debugging a exe. Cant find much on it anywhere so thought I'll put it up here. Any ideas as to what this could be used for?
CPU Disasm
Address Hex dump Command ...
- 63
5
votes
3
answers
228
views
Finding a malware object inside PE file
Today my AV found an antique piece of malware called Win9X.CIH.dam.
Instead of just removing it I would like to make a little research for fun.
What does "data0513" exactly mean? I can't understand ...
- 51
1
vote
0
answers
138
views
Decompiling DotNet2JScript malware?
I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
- 11
0
votes
1
answer
107
views
Identifying code that accesses encrypted overlay in PE
I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the ...
- 21
1
vote
1
answer
855
views
bypassing anti-VM inside protected samples
This is a good starting point.
As you know:
Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
- 163
1
vote
0
answers
471
views
ELF .text infection test
I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text ...
- 11
-2
votes
2
answers
1k
views
How can I export only the mnemonics from objdump (or any other program)?
I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this?
In other words of this output of objdump (objdump -d ...
- 103
3
votes
2
answers
10k
views
Dumping dll out of process
So there is executable malware, what when opened downloads dll from server or so and injects into target process. I checked properties of the target process in process hacker and clicked on .NET ...
- 31
1
vote
1
answer
321
views
De-obfuscation - Emulation-oriented vs Script-oriented
What are the advantages of each method when employing de-obsfucation of potentially malicious code?
I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
- 407
1
vote
2
answers
120
views
Test malware files in host machine?
To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly.
I want to know how to test malware files with out ...
- 121
4
votes
4
answers
20k
views
Finding OEP in a VMProtect v3.0 protected malware
I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...
- 395
1
vote
1
answer
186
views
Rootkit.Fileless.MTGen Reverse Engineering
Has anyone tried seeing what's inside of this malware? It ended up on one of our work machines. I copied the files to a thumb drive before setting the machine up for reimaging. Though the AV software ...
- 11
1
vote
1
answer
185
views
Which RE tool is missing?
I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not.
My problem is, that all the filenames and ClassNames are ...
- 111
2
votes
1
answer
633
views
Whether samples downloaded from virus share can execute automatically in my computer
I am doing some android malware analysis work and downloaded many android samples in virus share, but I found some of them are windows malware e.g. labeled 'win32' or something.
Are these windows ...
- 31
0
votes
1
answer
562
views
ELF64 Reflective Loading [closed]
I'm looking for an ELF64 reflective loader, so I can download an ELF and execute it without saving to disk?
Is anyone able to point me at one please? Or a clear one for ELF32 so I can translate?
...
0
votes
1
answer
269
views
Pyemu - cannot use PEPyEmu() module, Python
I want to run code from Gray Hat Python book for upx_unpacker. I have downloaded PyEmu, but when I run script I got this error:
AttributeError: PEPyEmu instance has no attribute 'load'
My script use ...
- 103
-2
votes
1
answer
86
views
Malware static rules? [closed]
Is there any sites to get static rules to detect malware files?
static behavior rules for detecting malware files.
Thanks in advance.
- 121
0
votes
1
answer
132
views
Configuring a C&C for a RAT [closed]
Where would I start when needing to configure a command and control server for a RAT?
So that my dynamic analysis can be more complete.
Note: I have been to the topics section of this stack exchange....
0
votes
2
answers
84
views
Composition of a Binary File trouble [closed]
I am working with some malware samples and I need to determine if one of them is primarily composed of 32-bit Intel Code. This would seem easy as I can just check the metadata describing it as a 32-...
0
votes
2
answers
4k
views
How to unpack and decrypt malware? [duplicate]
Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program ...
- 21
3
votes
1
answer
2k
views
Unable to unpack heavly obfuscated malware
I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted.
I tried all possible tools that I found ...
- 31
4
votes
2
answers
326
views
Analysing malware in a real environment (non-virtual environment)
I have analysed malware previously using Cuckoo Sandbox, however, I've seen that some malware won't run as they detect they are actually running in a virtual environment (they implement some anti-...
- 187
0
votes
1
answer
284
views
2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]
So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
1
vote
1
answer
1k
views
I'm would like to view this malicious payload, but am having trouble decoding it
This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this?
H4sIAAAAAAAAAL1X6W6jyBb+...
- 11
3
votes
1
answer
2k
views
Resolve Addresses To Function Names
I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
- 395
1
vote
1
answer
150
views
What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?
I was looking at the paper: "Improved Detection for Advanced Polymorphic Malware" by James Fraley who claimed to have used static, dynamic and file properties for increased malware detection. But is ...
4
votes
2
answers
1k
views
Reversing Self-Modifying Malware
recently i got my hands on one sample that self-modifies its .text section. So, I placed a breakpoint on .text section on write operation and then continued. I found out that it zeroes out the .text ...
- 395
1
vote
0
answers
2k
views
Attaching to Dalvik static function using Frida in order to disable emulator detection
I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get ...
- 11
0
votes
1
answer
2k
views
How can I dynamically debug a malicious DLL? [duplicate]
English isn't my first language, So I will do my best )
I am trying to analyze some malware NotPetya and I can run the malware by running :
rundll32.exe notpetya.dll #1
I am using Olly and trying ...
- 773
2
votes
1
answer
309
views
How to detect overlay data in RTF files?
How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
- 21