Questions tagged [malware]
Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.
326
questions
3
votes
2
answers
444
views
How to get all the references to function using PyDBG?
I'd like to get all the addresses in the binary that some function is called from using PyDbg. The address of the function will be supplied as a parameter.
Do I have actually to scan all the code, ...
- 3,002
15
votes
3
answers
3k
views
How do AV vendors create signatures for polymorphic viruses?
I was working on a hobby AV project using ClamAV's engine. While ClamAV is a good open source engine, it has poor support for detecting polymorphic viruses. The latest updated version failed to detect ...
- 685
4
votes
0
answers
361
views
How to add xrefs to indirect call targets in IDA? [duplicate]
I was analyzing win32.ramnit's dropper for fun. Almost all the calls it uses are indirect calls. I have figured out the destination addresses using manual analysis. But how can I add this information ...
- 685
5
votes
2
answers
4k
views
How to load a dumped process and several accompanied memory pages in IDA?
I have dumped process and several dumped pages of memory that were allocated in it. How can I load everything in IDA into one DB and reference pages in the loaded process?
- 3,002
7
votes
4
answers
2k
views
Program with no dependencies
while reading the answers to Can I statically link (not import) the Windows system DLLs? I came up with another question. So:
Is there a way to write a program that has no dependencies (nothing is ...
- 3,002
2
votes
0
answers
84
views
Opinions and suggestions regarding malware sandboxes [closed]
I'm relatively new in the field of automatic malware analysis and I'd like to ask about hands-on opinions about sandboxes in the following aspects:
extensibility of the product - adding your own ...
- 3,002
15
votes
3
answers
22k
views
Difference between DllMain and DllEntryPoint
I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following:
Run it with ...
- 491
2
votes
0
answers
467
views
MITRE MAEC (Malware Attribute Enumeration and Characterization) opinions and usage [closed]
I was looking at some MITRE projects and was wondering what you thought about, and if anyone was using or contributing to, the MITRE Malware Attribute Enumeration and Characterization project: https://...
- 71
15
votes
4
answers
4k
views
Debugging malware that will only run as a service
I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
- 153
6
votes
1
answer
250
views
Strange GDB behavior in OSX
I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...
user1743
8
votes
2
answers
2k
views
FEEDFACE in OSX malware
I was reverse engineering a piece of code in "Crisis" for fun and I encountered the following :-
__INIT_STUB_hidden:00004B8F mov eax, 8FE00000h
__INIT_STUB_hidden:00004B94
...
user1743
5
votes
2
answers
474
views
Why does an executable give an error when opened in $tool?
I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
- 325
4
votes
1
answer
250
views
How did/would you analyze OSX-Crisis
I was taking a look at the OSX-Crisis sample obtained from this site and trying to analyze it for fun and learning. Choosing to disassemble as a Mac binary causes the start function to be discovered ...
user1743
15
votes
2
answers
12k
views
What are the different types of packers?
I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved.
Yet, it seems that ...
- 18.9k
14
votes
5
answers
3k
views
How to capture an "in-memory" malware in MS-Windows?
I have an infected MS-Windows 7 machine with an in-memory malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some ...
- 18.9k
4
votes
0
answers
596
views
How accurate is Cerberus for reverse engineering malware? [closed]
AccessData's Cerberus product claims to be :
The first step towards automated reverse engineering, Cerberus allows
you to determine the behavior and intent of suspect binaries, giving
you ...
- 173
9
votes
2
answers
7k
views
What are the differences between metamorphic, oligomorphic and polymorphic malware?
Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, ...
- 18.9k
16
votes
4
answers
7k
views
INT 2D Anti-Forensic Method
Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
- 263
20
votes
4
answers
7k
views
How common are virtualized packers in the wild?
I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
- 413
10
votes
2
answers
2k
views
Is there an easy way to detect if the SSDT has been patched from a memory dump?
The SSDT is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain ...
- 1,252
76
votes
9
answers
85k
views
Analyzing highly obfuscated JavaScript
I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
- 963
16
votes
1
answer
3k
views
Malware Hooking INT 1 and INT 3
I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
- 4,056
8
votes
2
answers
25k
views
What happens when a DLL is added to AppInit_DLL
I have a malware sample that adds a DLL to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs. There is malicious functionality in the DLL referenced by the ...
- 1,326
5
votes
1
answer
176
views
How to investigate function calls across a batch of targets?
Say I have a collection of N executables, where N is large enough to make repetitive manual analysis tedious. I want to process all of these files and extract information about certain function calls, ...
- 109
132
votes
14
answers
126k
views
Where can I, as an individual, get malware samples to analyze?
It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users.
The bottleneck here for people aspiring to break ...
66
votes
4
answers
5k
views
How can I analyze a potentially harmful binary safely?
I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
- 1,475