Questions tagged [malware]
Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.
326
questions
0
votes
1
answer
452
views
Getting Xrefs to Windows Library Functions in IDA Pro
Ok so let's say that a program obfuscated its IAT and i can't see it in IDA Pro. In OllyDbg there is a plugin where you press Ctrl+G you can search for a library function and set a breakpoint even ...
- 395
2
votes
2
answers
2k
views
Packed PE file and weird Header
I'm new to reverse engineering, so I don't know if my question will be easy or not.
Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings :
000003d0: 0055 5058 ...
- 21
8
votes
1
answer
5k
views
How tools like PEiD find out the compiler and its version.
How tools like PEiD and CFF explorer find out the compiler and its version.
I am analyzing a executable file. Which shows: Borland Delphi 3.0
But the section names .text .rsrc. Which is usually ...
- 81
0
votes
2
answers
666
views
Manual unpacking petya ransom [closed]
I want to manually unpack red Petya ransomware. I used Ollydbg for unpacking and set breakpoint on VirtualAlloc to see the "MZ" header in memory dump, and saved it to a file. But the saved file is not ...
- 1
1
vote
3
answers
7k
views
How can I export only the opcodes from objdump (or any other program)
I have multiple malware files, I want to do an analysis with the opcodes. Im able to export everything to text but I only need the middle column. Any idea on how can I solve this?
In other words of ...
0
votes
1
answer
144
views
Information about packers
i was trying to search for some information about packers just to learn more about it, there is a lot of stuff out there but its hard to find something that really explain that good and clear,
I would ...
- 45
1
vote
0
answers
370
views
What do malicious programs use the ESENT registry key for?
I was analyzing a piece of malware and noticed it created this registry key.
hkey_local_machine\software\microsoft\ esent\process{malware file name}\debug
Some googling told me that esent is just a ...
- 11
3
votes
1
answer
2k
views
What conditions can create the "Not a Valid Win32 Application" error message upon load?
I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load.
I've tried changing ...
- 1,830
2
votes
2
answers
252
views
VBA code detection in MS office documents
So, lately I've been working on a project involving malware which gets spread via MS Office documents and, among other things, I need to detect the VBA code in appropriate document streams.
I've read ...
- 1,063
0
votes
1
answer
3k
views
Extracting embedded dlls from .NET executable
I have a .NET executable that apparently has some embedded DLLs. It's just one standalone executable. I opened this executable with JetBrains dotPeek and ILSPY, both decomiplier are showing DLL names ...
- 33
6
votes
2
answers
1k
views
What PE anomalies can crash the Windows Loader or cause a file to not load?
I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I ...
- 1,830
1
vote
1
answer
167
views
Likely malicous Javascript-interested in how it works
Got this interesting bit of code compressed in an email named "Install-MSOffice365-WebView-Plugin-Update-0.165.11a.exe.js" that is undoubtedly malicous, but was curious what it does and am not much of ...
- 11
1
vote
0
answers
75
views
Where can I get a good description about windows build-in exe programs like wupdmgr.exe?
I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe.
Is there any "msdn" alike repository but for exe ...
- 125
8
votes
2
answers
1k
views
Automated Static Unpacking Binaries
I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
- 1,410
-2
votes
1
answer
1k
views
Aside from Assembly, should I learn C or C++?
With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
2
votes
1
answer
910
views
SWF flash analysis
An SWF file was recently detected by Windows Defender as SWF/Meadgive. I uploaded a sample to VT and only Microsoft flagged it as malicious. As of today's signatures I am not seeing any further ...
- 21
0
votes
0
answers
125
views
What is the name of this technique?
A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual ...
- 111
5
votes
3
answers
838
views
Is there any websites to get malware files using YARA rules?
I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules?
Note: I know some websites to get android malware samples using YARA.
But, I need Windows ...
- 121
2
votes
1
answer
2k
views
how to overcome setunhandledexceptionfilter in ollyDebugger?
I am debugging a malware sample which is using setunhandledexceptionfilter() for anti-debugging. I don't know how to handle this.
Can you guys please explain the setunhandledexceptionfilter() anti-...
- 121
-2
votes
1
answer
95
views
Need help in understanding the code of a "Malicious" file [closed]
I'm testing a malware sample :
hxxps://www.virustotal.com/en/file/55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd/analysis/
This is a malicious executable file. When executed in ...
- 1
2
votes
1
answer
501
views
DGA(Domain Generation Algorithm) based malware files
Where i can get DGA (Domain Generation Algorithm) based malware files for analysis?
And,Can I get malware family names which is using Domain Generation Algorithm?
- 121
5
votes
2
answers
848
views
Safe way to download a malware payload?
I'm trying to analyze a piece of malware that is most-likely a downloader. During dynamic analysis on an isolated VM network, Wireshark registered a GET request to a server for what I believe is the ...
- 163
3
votes
2
answers
2k
views
How to debug malware that injects itself into another process?
I am kind of new in the field of reverse engineering, so sorry if it is a silly question.
I have to analyse some malwares for my bachelor thesis and I am currently trying
to reverse engineer a ...
- 33
0
votes
1
answer
2k
views
Can't debug a service
I am working on Lab11-03 in "Practical Malware Analysis" book.
The malware I am analyzing trojanized the file cisvc.exe which is the indexing service in Windows XP.
After that the malware ...
- 573
0
votes
2
answers
1k
views
sandbox for analyzing network traffic
I am in search of looking an open source sandbox that has the following features:
- route my network traffic to the sandbox for analysis
- perform analysis on network traffic to detect malicious ...
- 171
0
votes
1
answer
88
views
Where can I get systematic problems and solutions for debugging?
I know PEFile headers, assembly language, and other basic stuff.
I am looking for some site or book which systematically teaches me debugging and reversing. Something like "Let us C" for C language.
...
- 21
2
votes
1
answer
622
views
What is Executable Compression? [closed]
I don't know whether this is the right place for this question or this question is too basic.
I was reading Antivirus Hacker's Handbook, where they talked a bit about software packers, protectors, ...
- 133
1
vote
0
answers
60
views
Reverse Engineer an iOS MP4 Bug [duplicate]
Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
- 131
3
votes
1
answer
1k
views
Good foundation for reverse engineering malware
I have been intrigued by reverse engineering recently and just finished Paul Carter's PC Assembly Language book (http://pacman128.github.io/static/pcasm-book.pdf) which was a great primer for x86. My ...
- 187
1
vote
1
answer
4k
views
How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?
When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
1
vote
1
answer
151
views
IDA pro can not resolved section after unpacking procedure
I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as DD.
Is this sample still packed ...
- 11
0
votes
1
answer
884
views
Restoring an Infected appending virus EXE file by
I'm trying to restore a file that was infected by a virus (gaelicum or tenga)
It's an appending virus.
This is the warning I get when opening it in OllyDbg
: ---------------------------
Entry Point ...
- 103
1
vote
1
answer
142
views
Is this request mask algorithm reversible?
I am trying to understand an algorithm from a malware I found. This algorithm encodes http request to C&C. The decompiled version is taken from IDA. There are some comments I wrote.
The problem ...
- 155
0
votes
2
answers
580
views
How to download Linksys firmware from router
A co-worker gave me his mom's Linksys router that he is convinced has been hacked to include a MitM. We could just upgrade the firmware, but that wouldn't be any fun and so I thought this might be a ...
- 1
1
vote
2
answers
2k
views
Anti-VM and anti-sandbox malware samples
I'm learning malware analysis.
I'm looking for malware samples that terminate themselves when recognize working on a VM or sandbox.
Thanks.
- 11
5
votes
1
answer
224
views
Where can I, as an individual, find clean programs to analyze?
This question includes a good list of sources where an individual might collect malware samples for analysis.
I'd like to get a large number of public, non-malicious programs for the purpose of ...
- 159
3
votes
1
answer
578
views
How can I determine if a piece of code is an encryption algorithm?
I am trying to reverse engineer a malware, and came across a piece of code that I suspect is an encryption/decryption procedure, however I do not know for sure. I can recognize that it extracts its ...
- 155
5
votes
3
answers
4k
views
Where can I find benign samples with a high potential to false positive?
In the pursuit and development of malware detection algorithms, often a big sample set of both malicious and benign samples is required. Both machine learning or similar automated techniques, as well ...
- 11.7k
0
votes
2
answers
4k
views
Recognize the library functions of statically linked executable file in IDA Pro
Recently I worked on a Linux program which has all of its symbols stripped. Opening it with IDA resulted in none of its functions identified.
Thus I tried to extract any usable information from the ...
- 3
2
votes
1
answer
421
views
Why is otkloadr.WRAssembly.1 reference present in a office file?
I was working with a RTF file and I found the string "otkloadr.WRAssembly.1" present inside the file in plain sight.
I know that many exploits use this for loading the msvcr71.dll (non-ASLR module).
...
- 391
0
votes
1
answer
811
views
Malware samples to analyze with existing disassembly?
Hopefully this question isn't get marked as Duplicate, since it differs from the following question:
Where can I, as an individual, get malware samples to analyze?
I'm looking for samples (ideally ...
- 1,257
2
votes
2
answers
2k
views
Unable To break TLS callback function using ollydbg
while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put "System entry breakpoint" as in ollydbg Event option.Binary breaks as system breakpoint ...
- 119
2
votes
1
answer
259
views
Distribution of malware obfuscation types
There are several statistics and numbers out there of current malware families and their distributions.
However, I'am looking for statistics which shows the distribution of malware differed by their ...
- 33
0
votes
2
answers
335
views
Can benign applications have such APIs?
I am new to malware analysis .. and I was analyzing some 'windows' apps and found functions that I thought it exist only on malware, is this possible or there is something wrong with my analysis ?
I ...
- 187
1
vote
2
answers
190
views
Obfuscation by changing the order of a malware behaviour
I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used.
However, is there a similar technique that changes ...
- 187
0
votes
1
answer
320
views
What is the relationship between the Windows API and the C run time library? [closed]
I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.)
...
- 1
0
votes
1
answer
434
views
Entry point of malicious child process
OK...I have a file which, upon execution, runs a copy of itself as a child process, with, obviously, different behaviors. Since this (obviously) means that OllyDBG isn't going to be able to see what ...
2
votes
1
answer
1k
views
How to search sequence of API call using IDA Pro?
I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
- 141
0
votes
1
answer
147
views
Unknown algorithm in forloop
i am reversing a malware sample .but getting stucked in a loop below.the line written in the bold letter generated random letter like "/2","/lm32" etc to EDX.The thing is that ECX does not contains ...
- 119
11
votes
1
answer
873
views
Randomly picking up a x86 register for an instruction
I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction
Which i don't understand how this ...
- 314