Questions tagged [malware]
Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.
326
questions
3
votes
2
answers
631
views
Crash after exe modification [closed]
I am testing a malware that built as COM EXE service. This exe file has a digital signature.
I succeeded to remove the digital signature for trying to modify it for reverse engineering tests.
But when ...
- 211
2
votes
0
answers
139
views
Does anybody knows a good dataset for malware families? [duplicate]
Does anybody knows a good dataset for malware families?
What i need is a dataset where malware are already classified in families.
And is not duplicate of "Where can I, as an individual, get malware ...
- 129
-1
votes
1
answer
315
views
how can one cause heap memory buffer overflow in a worker process by using a specially crafted request? [closed]
i am to web applications so i have recently published my website and ran a penetration test using Acunetix Vulnerability scanner
so i have found the following result and for me to experience a lot ...
0
votes
1
answer
1k
views
where i can get android malware samples to analyze? [duplicate]
Is there any sites to get new android malware files(.apk files) for analysing purpose?
and also suggest me some blogs/sites for android malware analysis?
Please reply me ASAP.
Thanks in advance.
- 121
3
votes
1
answer
1k
views
Dump a child process created by malware with an ALTERNATIVE process hollowing process
I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , ...
- 31
2
votes
0
answers
178
views
Collecting malware samples [duplicate]
Could you please list some sites from where I could download viruses/worms/trojans in .exe format. I have read the answers to the other similar questions but couldn't make much use of them.
I am a ...
- 131
1
vote
1
answer
74
views
How to get Waledac and Storm P2P botnets [duplicate]
I am going to conduct a research on p2p botnet detection based on their network behavior. Would you help me how to get these botnets sample.
Thanx!
- 11
1
vote
0
answers
602
views
Get DLL from EXE file [duplicate]
I am trying to reverse engineer an DLL that is loaded from a EXE.
I don't have the DLL file. I just have an executable file that injects the DLL into a certain process.
When I try using ollydbg or ...
- 11
2
votes
1
answer
2k
views
How do malware steal Code signing certificates?
While analyzing/studying/RE exe's/dll's you see the certificates in peview/hexeditor etc. but how does one come to know that the certificate is a fake/malicious/expired one, there has to be a ...
- 391
-1
votes
1
answer
1k
views
Extracting Opcodes of a binary
I want to extract opcodes 'Assembly instructions' from malware binaries . and because I have large number of samples I don't want to do it invidiously .. instead I want to automate the process of ...
- 187
1
vote
0
answers
796
views
SysTracer by SysReveal.com clean?
SysTracer from SysReveal.com (not from www.blueproject.ro) seems to be a very nice tool for live monitoring your system and check what executable files do at your system. I saw some videos on YouTube ...
- 111
2
votes
2
answers
365
views
Dynamic analysis of malware samples
I have thousands of Linux malware samples in ELF format. And I am thinking to use dynamic analysis (say, PIN) to obtain an execution trace of each malware sample.
However, I am afraid such activity ...
- 2,475
1
vote
1
answer
1k
views
How to get Arg in Ollydbg
I am In A deep Trouble. I am New to Reverse Engineering. I am Currently Using OLLYDBG. Now, I was Trying to Crack the Password of a .exe file using Ollydbg
Now, The EXE file which i was trying to ...
- 29
0
votes
1
answer
1k
views
RANSOMWARE SCRIPT decryption
I have a friend with PC which is infected with some sort of "RANSOMWARE" - a type of malware where will encrypt your files(images,videos and documents) and ask for payment for decryption.
I managed ...
- 11
2
votes
3
answers
322
views
What is the average time for "defusing" malware self-protection mechanisms?
I always wondered how much time is needed to get rid of all that anti-VM/crypto/protector/anti-debug stuff (without analyzing actual payload and purpose), especially if you're dealing with malware on ...
- 53
3
votes
8
answers
3k
views
Is MD5 hashing of files a valid method of creating an anti-virus program?
Is it a good way to create Virus signature in MD5 or it is better in SHA1 or SHA256 and why it is?
- 41
6
votes
2
answers
908
views
Reverse Engineering Chinese laser engraver
I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is ...
- 63
-2
votes
1
answer
1k
views
How rootkits hide services on kernel mode? [closed]
How rootkits hide services on kernel mode?
thanks
- 121
0
votes
1
answer
73
views
Why is there no MFCxx.dll in the import table?
I have an exe which I'm confident uses MFC(I have seen the code and it heavily uses MFC) but when I see the Import Table why don't I see MFCxx.dll entry...
- 391
0
votes
1
answer
758
views
open source static or dynamic malware unpacker
I am looking for static and dynamic unpacker tools. I only found PE-Explorer the only can handle UPX packer.
So I am carious to know is there any open source static or dynamic unpacker?
- 171
2
votes
1
answer
1k
views
Hidden code in dissasembly
I'm testing malware that built from single EXE file and it doesn't load any other DLLs.
I can see that EXE is register as COM object (I don't know how EXE can be COM object...). But when I run it and ...
- 211
1
vote
0
answers
52
views
Where can I get a dataset of URLs of websites that diffuse malware? [duplicate]
In order to study some malware detection algorithms I am developping in my PhD, I would like to know where I could download a list of malware websites.
Thank you
- 11
2
votes
1
answer
224
views
Documentation of malware reverse engineering
I'm interesting in reversing malware. The problem is, that if you analyse malware on your own you don't know how efficient you are, and with which techniques/tools/methods you can use for better ...
- 426
3
votes
0
answers
277
views
Malware analysis - AntiDebugging - Malware slows down the PC while being debugged
As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution:
Being executed
Decrypt a lot of data from memory and obtain a new PE (from memory)
Create a child ...
- 668
4
votes
2
answers
3k
views
Reversing a Windows service
I am trying to reverse engineer a malware that open a windows service dynamically in OllyDbg.
When the malware calls StartServiceCtrDispatcherW, I receive an error:
How I can continue to analyze ...
- 43
3
votes
2
answers
1k
views
Why hook a function rather than set a breakpoint
I know hooking is usually used as a technique when one would rather use external (or injected) code to manipulate an executable, vs breakpoints which are usually set by a debugging framework in an ...
- 368
0
votes
2
answers
1k
views
Is it dangerous to disassemble malware in IDA?
If I were to disassemble a malware sample in IDA without being in a VM, is there any way I can infect my machine?
- 111
1
vote
3
answers
691
views
What is the average time for malware analysis?
I was wondering what is the average time for you to classify (by reverse engineering) if a suspicious file is a malware or not?
Thanks
- 19
0
votes
1
answer
200
views
Reverse engineer malware embedded in Microsoft rtf
I am currently trying to analyse a particular document that was flagged as malware in our honey pot.
In virus total is shows up as being a Trojan and I have reason to believe it might be connected to ...
- 773
3
votes
1
answer
2k
views
Unable to dump a process
I'm trying to reverse a malware sample with the following MD5: ef668a0cd0755c67930ece13d28a6bda.
Obvious, this is a packed malware. On a first look, it seems to bee some GUI Programm, but at some ...
- 426
-1
votes
1
answer
150
views
What certifications do I need to become a Malware Analyst? [closed]
I've previously posted here on how to get started as a malware analyst, and wanted to say thanks on getting me started. How much do certifications help me in for my resume and which one(s) should I ...
0
votes
1
answer
380
views
How do I make a YARA signature that does NOT look in the resource section?
I'm trying to use YARA to sort out a variety of files into families. Some malware drops other malware from images within their resource images. What I'd like to do is write a signature that ignores ...
- 143
2
votes
3
answers
7k
views
Where can I get Linux malware samples?
There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
- 117
0
votes
2
answers
2k
views
Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?
I can access the FS:[0h] which points to the SEH chain but cannot do the same for other segment registers.What is the reason for it ?
Also,I was debugging an exe which has PTRD at 0x600 and AEP at ...
- 391
1
vote
0
answers
117
views
unpack a malware manually [duplicate]
I`m working on this malware to analyze:
http://www.freeuploadsite.com/do.php?id=74209
password: infected
It seems it is packed but when I use "PE View" , etc tools to find the packer, their results ...
5
votes
2
answers
2k
views
Need advice : Reverse engineering a pdf with shellcode
Problem :
I try to find the plaintext which was hidden at pdf inbuilt with shellcode
What i tried :
I received a pdf which contains javascript with it ,i dig the pdf as follows :
Exploring ...
- 1,097
1
vote
2
answers
757
views
Debugging Win32.Upatre - why does Ollydbg fail to analyze this?
So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze?
And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog.
I started analyzing ...
- 133
2
votes
2
answers
2k
views
How can I extend a memory of an analysed executable in IDA Pro?
I'm analysing some malware executable with ImmDBG and IDA Pro.
The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides ...
- 426
1
vote
0
answers
105
views
How do I become a Malware Analyst? [duplicate]
Sorry if this is posted in the wrong section.
A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in ...
- 11
-3
votes
1
answer
623
views
What are the risks of running a decompiler? [closed]
I have a binary file which is potentially a virus and I wish to look into its internals. I need to be cautious as I don't want it to run on my system. That's why I ruled out gdb.
I've searched and ...
- 13
2
votes
2
answers
2k
views
Generating call graph for assembly instructions
I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I ...
- 171
2
votes
1
answer
932
views
Why does an exe's import Table have two refrences to kernel32.dll (or any other dll)?
According to what I know, Import Descriptor table is made of an array of _IMAGE_IMPORT_DESCRIPTOR structures. There is one _IMAGE_IMPORT_DESCRIPTOR for every dll that is imported.
I have an exe which ...
- 391
1
vote
3
answers
1k
views
Best and smarter way to improve unpacking skills
I want to find a way to improve my unpacking skills, i am not a noob but i miss steps from simple to hard packers.
I saw lot of video tutorials, the most of the time i see "click F9 x times to reach ...
- 319
4
votes
2
answers
11k
views
When to use Windbg and Ollydbg?
According to what I know :WinDbg uses debugging information (pdb/symbol files) for debugging.So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb. Is ...
- 391
3
votes
4
answers
13k
views
Unpacking and dumping using ollydump
I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone ...
- 303
3
votes
2
answers
401
views
Will this code run in real machine or is it some kind of Anti Reversing code?
I am reversing a file which is not running properly in Vmware.The code from the AEP is as shown below :
POP EDI ; value of edi is 0x7C816D4F kernel32.7C816D4F
PUSH EAX ;value of eax is 0
INC ...
- 391
2
votes
1
answer
840
views
Studying Zeus 2.X
I'm doing some study on Zeus 2.x, trying to wrap my head around how it works. By using this code. I've built my own builder to work on my test environment.
Right know I want to do a very specific ...
- 51
0
votes
0
answers
466
views
Does malware ever purposely embed resources to thwart resource analysis and extraction
I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
- 233
3
votes
1
answer
889
views
Where to find a full analysis of the encryption scheme of CTB-Locker?
CTB-Locker is a currently active ransomware that encrypts files to lock users out.
Here are a few links about this malware:
A new generation of ransomware: Elliptic curve cryptography + Tor + ...
- 18.9k
1
vote
1
answer
361
views
Where can i download malware variants [duplicate]
How/Where can i get variants of a malware ?
The only thing that concerns is that the variants must be a continuous update of the previous one
- 21