Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Filter by
Sorted by
Tagged with
0
votes
1answer
189 views

Reverse engineer malware embedded in Microsoft rtf

I am currently trying to analyse a particular document that was flagged as malware in our honey pot. In virus total is shows up as being a Trojan and I have reason to believe it might be connected to ...
3
votes
1answer
2k views

Unable to dump a process

I'm trying to reverse a malware sample with the following MD5: ef668a0cd0755c67930ece13d28a6bda. Obvious, this is a packed malware. On a first look, it seems to bee some GUI Programm, but at some ...
-1
votes
1answer
149 views

What certifications do I need to become a Malware Analyst? [closed]

I've previously posted here on how to get started as a malware analyst, and wanted to say thanks on getting me started. How much do certifications help me in for my resume and which one(s) should I ...
0
votes
1answer
355 views

How do I make a YARA signature that does NOT look in the resource section?

I'm trying to use YARA to sort out a variety of files into families. Some malware drops other malware from images within their resource images. What I'd like to do is write a signature that ignores ...
2
votes
3answers
6k views

Where can I get Linux malware samples?

There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
0
votes
2answers
1k views

Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?

I can access the FS:[0h] which points to the SEH chain but cannot do the same for other segment registers.What is the reason for it ? Also,I was debugging an exe which has PTRD at 0x600 and AEP at ...
1
vote
0answers
113 views

unpack a malware manually [duplicate]

I`m working on this malware to analyze: http://www.freeuploadsite.com/do.php?id=74209 password: infected It seems it is packed but when I use "PE View" , etc tools to find the packer, their results ...
5
votes
2answers
2k views

Need advice : Reverse engineering a pdf with shellcode

Problem : I try to find the plaintext which was hidden at pdf inbuilt with shellcode What i tried : I received a pdf which contains javascript with it ,i dig the pdf as follows : Exploring ...
1
vote
2answers
670 views

Debugging Win32.Upatre - why does Ollydbg fail to analyze this?

So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze? And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog. I started analyzing ...
2
votes
2answers
2k views

How can I extend a memory of an analysed executable in IDA Pro?

I'm analysing some malware executable with ImmDBG and IDA Pro. The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides ...
1
vote
0answers
100 views

How do I become a Malware Analyst? [duplicate]

Sorry if this is posted in the wrong section. A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in ...
-3
votes
1answer
429 views

What are the risks of running a decompiler? [closed]

I have a binary file which is potentially a virus and I wish to look into its internals. I need to be cautious as I don't want it to run on my system. That's why I ruled out gdb. I've searched and ...
2
votes
2answers
1k views

Generating call graph for assembly instructions

I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
2
votes
1answer
730 views

Why does an exe's import Table have two refrences to kernel32.dll (or any other dll)?

According to what I know, Import Descriptor table is made of an array of _IMAGE_IMPORT_DESCRIPTOR structures. There is one _IMAGE_IMPORT_DESCRIPTOR for every dll that is imported. I have an exe which ...
1
vote
3answers
1k views

Best and smarter way to improve unpacking skills

I want to find a way to improve my unpacking skills, i am not a noob but i miss steps from simple to hard packers. I saw lot of video tutorials, the most of the time i see "click F9 x times to reach ...
4
votes
2answers
10k views

When to use Windbg and Ollydbg?

According to what I know :WinDbg uses debugging information (pdb/symbol files) for debugging.So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb. Is ...
1
vote
0answers
229 views

Analysis target modifies debugging registers during initial file open in ollydbg

While opening a binary in Ollydbg, I get a warning that the debugged program has modified the debugging registers. The following entry is in the log: Address: 7749218E Modified debug registers of main ...
3
votes
4answers
11k views

Unpacking and dumping using ollydump

I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone ...
3
votes
2answers
389 views

Will this code run in real machine or is it some kind of Anti Reversing code?

I am reversing a file which is not running properly in Vmware.The code from the AEP is as shown below : POP EDI ; value of edi is 0x7C816D4F kernel32.7C816D4F PUSH EAX ;value of eax is 0 INC ...
2
votes
1answer
779 views

Studying Zeus 2.X

I'm doing some study on Zeus 2.x, trying to wrap my head around how it works. By using this code. I've built my own builder to work on my test environment. Right know I want to do a very specific ...
0
votes
0answers
450 views

Does malware ever purposely embed resources to thwart resource analysis and extraction

I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
3
votes
1answer
859 views

Where to find a full analysis of the encryption scheme of CTB-Locker?

CTB-Locker is a currently active ransomware that encrypts files to lock users out. Here are a few links about this malware: A new generation of ransomware: Elliptic curve cryptography + Tor + ...
1
vote
1answer
351 views

Where can i download malware variants [duplicate]

How/Where can i get variants of a malware ? The only thing that concerns is that the variants must be a continuous update of the previous one
4
votes
1answer
1k views

What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?

I know that Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. while Static program analysis is the ...
2
votes
2answers
1k views

Unpacking a backdoor program for studying

I wanted to learn something about unpacking malware manuelly and found the following link: writequit.org/blog/?p=165. As you can see, the malware in that example begins with the PUSHAD instruction....
2
votes
1answer
3k views

Unable to dump malware assembly using objdump

I'm trying to dump assembly code of a ShellShock malware explained in this blog post: MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... . After dumping using objdump -...
1
vote
1answer
309 views

Question about process injection

During an analysis, I found the following piece of malware: ... lea eax, [ebp+ThreadId] push eax ;lpThreadId push ebx ;dwCreationFlags push [ebp+...
6
votes
2answers
834 views

Decompiling .NET marshaled code

There's a .NET malware sample I'm trying to analyze, which goes more or less like this: internal static class Class1 { public static byte[] Code = new byte[] { 9, 249, ...
1
vote
1answer
291 views

Tracing adware on windows - ads showing up in browser

Sometime ago I came across this situation: Windows 7 machine infected with adware, ads tabs opening up in chrome out of nowhere. Pretty invasive stuff. In the end i got rid of it with some malware ...
0
votes
1answer
131 views

What is the relation between binary (executable) instructions and execution instruction [closed]

What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ? In other world, in area of malware analysis a binary ...
3
votes
3answers
4k views

Detecting packed 64-bit Windows Portable Executable (EXE) files

What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files). I am not interested in the packer used I would just like to know if the file is packed or ...
4
votes
1answer
539 views

Computer Malware: More complex than metamorphic?

I have read the topic on oligo-, poly- and metamorphic malware. I have done a quick google search, and it seems like the concept of metamorphic malware was already known in the DOS age and in the ...
3
votes
4answers
445 views

Search remote malware zoo for homologous samples

I've got the following problem: I'd like to find new binaries of a certain malware family -- unpacked -- for subsequent analysis (active C&C comms analysis). Is there a database of binaries ...
1
vote
0answers
277 views

Is there any technique called “DLL Replacement”?

I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) ...
-2
votes
1answer
1k views

How does this test for debugger [closed]

While reading a book it mentioned that the following code is usually used to as an antidebugger mov eax, large fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] retn I don't ...
2
votes
3answers
5k views

How to figure out which imported function(s) in a virus determine its behaviour?

I want to know how to find the functions which is interesting in malware tools. For example, I have a sample of unknown virus (this sample is lab01-01.exe in the book practical malware analysis lab1-...
-4
votes
2answers
3k views

Anti-debug techniques for MS-Windows?

Is there any anti-debugger tricks used by malware other than interrupt INT 0x2D ? And, how do they work ? Working examples would be really nice !
2
votes
1answer
156 views

Is data exfiltration possible without obvious system calls? [closed]

http://resources.infosecinstitute.com/data-exfiltration-techniques/ I am teaching myself to identify exfiltration of sensitive data with malicious binaries. One thing I have noticed, is in most ...
1
vote
1answer
984 views

How to change PE signature? [closed]

I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool ...
0
votes
1answer
136 views

How to decide file is malware or not? [closed]

How should I decide file is malware or not. Before reverse engineering any file, I should be suspect the file. What are the various ways to decide if exe is malicious? Thanks
5
votes
1answer
2k views

How to create a virus signature from decompiled source

I have a problem where I have to create a virus signature for the Stoned Virus (Although this could apply to any virus/file). Let's assume I have a copy of the compiled and decompiled program. I then ...
2
votes
0answers
177 views

Malware terminated in Ollydbg after a while - Why? [closed]

I try to analyze a backdoor program with ollydbg. When I go through the assembly code by clicking the "Step Over"-Button, i stop sometimes to make a notice on a paper. Later when i want to go trough ...
6
votes
2answers
642 views

Reverse engineering Perl-compatible regular-expressions

I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (...
3
votes
2answers
4k views

Alternative to CaptureBAT on Windows 7?

I am working on some malware that currently only runs with Windows 7 is detected. I would like to use CaptureBAT, but it doesn't work on Windows 7 (with the exception of network monitoring). Is there ...
7
votes
2answers
2k views

Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE

As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and last 1024) in some type of custom CFB XOR encryption. I ...
2
votes
1answer
741 views

Are jump instructions targeting addresses in ntdll a sign of malware?

For fun I downloaded an installer from a "driver downloads" website. I do NOT intend on installing it, but I was interested to check it out just to see what it looked like. I tossed it into Ollydbg (...
5
votes
2answers
288 views

How can we determine that malware are related?

I am curious to know about how researchers can know when different malware are related. for example: Stuxnet, Flame or Duqu, are told to be written by the same group. Does anyone know how they figure ...
5
votes
3answers
3k views

How to break on not-yet-loaded kernel driver

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
-2
votes
1answer
867 views

How do anti-virus programs catch a virus? How they detect it? [closed]

I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?
5
votes
2answers
3k views

how to reverse DeviceIoControl?

I have started reversing this piece of malware. At some point it creates a service and starts it, then immediately it calls the function DeviceIoControl and the malware went from "paused" to "running" ...