Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Filter by
Sorted by
Tagged with
0
votes
1answer
283 views

Entry point of malicious child process

OK...I have a file which, upon execution, runs a copy of itself as a child process, with, obviously, different behaviors. Since this (obviously) means that OllyDBG isn't going to be able to see what ...
0
votes
1answer
139 views

Unknown algorithm in forloop

i am reversing a malware sample .but getting stucked in a loop below.the line written in the bold letter generated random letter like "/2","/lm32" etc to EDX.The thing is that ECX does not contains ...
0
votes
1answer
61 views

Why is there no MFCxx.dll in the import table?

I have an exe which I'm confident uses MFC(I have seen the code and it heavily uses MFC) but when I see the Import Table why don't I see MFCxx.dll entry...
0
votes
1answer
619 views

open source static or dynamic malware unpacker

I am looking for static and dynamic unpacker tools. I only found PE-Explorer the only can handle UPX packer. So I am carious to know is there any open source static or dynamic unpacker?
0
votes
1answer
181 views

Reverse engineer malware embedded in Microsoft rtf

I am currently trying to analyse a particular document that was flagged as malware in our honey pot. In virus total is shows up as being a Trojan and I have reason to believe it might be connected to ...
0
votes
1answer
339 views

How do I make a YARA signature that does NOT look in the resource section?

I'm trying to use YARA to sort out a variety of files into families. Some malware drops other malware from images within their resource images. What I'd like to do is write a signature that ignores ...
0
votes
1answer
125 views

What is the relation between binary (executable) instructions and execution instruction [closed]

What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ? In other world, in area of malware analysis a binary ...
0
votes
0answers
51 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
0
votes
0answers
76 views

Reverse engineering .NET malware - iloveyou.exe

I have a .NET malware sample whose dynamic behavior I understand. It is also packed. de4dot identified the obfuscator as .NET Reactor, so I used de4dot to de-obfuscate it. However, after de-...
0
votes
0answers
52 views

idapython - Scan all possible code paths between start and end addresses

I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
0
votes
1answer
100 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
0answers
36 views

Replacing a function call with it's result in a script

I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function. The problem is that this ...
0
votes
1answer
126 views

ida pro issue debugging issues with ntdll [closed]

I am using IDA pro to follow along a youtube video of RE from OALabs. https://www.youtube.com/watch?v=kdNQhfgoQoU&t=1575s I am facing a problem when i try to put a break point on functions in ...
0
votes
2answers
69 views

Composition of a Binary File trouble [closed]

I am working with some malware samples and I need to determine if one of them is primarily composed of 32-bit Intel Code. This would seem easy as I can just check the metadata describing it as a 32-...
0
votes
1answer
1k views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
0
votes
1answer
687 views

Can't debug a service

I am working on Lab11-03 in "Practical Malware Analysis" book. The malware I am analyzing trojanized the file cisvc.exe which is the indexing service in Windows XP. After that the malware start the ...
0
votes
1answer
1k views

where i can get android malware samples to analyze? [duplicate]

Is there any sites to get new android malware files(.apk files) for analysing purpose? and also suggest me some blogs/sites for android malware analysis? Please reply me ASAP. Thanks in advance.
0
votes
0answers
439 views

Does malware ever purposely embed resources to thwart resource analysis and extraction

I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
0
votes
0answers
263 views

Is there any technique called “DLL Replacement”?

I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) ...
0
votes
1answer
111 views

Configuring a C&C for a RAT [closed]

Where would I start when needing to configure a command and control server for a RAT? So that my dynamic analysis can be more complete. Note: I have been to the topics section of this stack exchange....
0
votes
1answer
197 views

2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]

So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
-1
votes
1answer
146 views

What certifications do I need to become a Malware Analyst? [closed]

I've previously posted here on how to get started as a malware analyst, and wanted to say thanks on getting me started. How much do certifications help me in for my resume and which one(s) should I ...
-1
votes
2answers
164 views

CreateThread returns true but thread doesn't run [closed]

I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions. The call to the CreateThread returns a valid handle ...
-1
votes
1answer
147 views

Finding a specific malware sample [closed]

I am trying to find for analysis the scuinst.exe binary (R2D2 aka Bundestrojaner), but I can not find it. Where can I find this binary?
-1
votes
1answer
54 views

malware analysis [closed]

I tried to use process monitor to find out what program 4.exe did on my system. However, I could not find what changes were made. I believe that this program modifies some files and the registry, but ...
-1
votes
1answer
248 views

Whether samples downloaded from virus share can execute automatically in my computer

I am doing some android malware analysis work and downloaded many android samples in virus share, but I found some of them are windows malware e.g. labeled 'win32' or something. Are these windows ...
-1
votes
1answer
601 views

Aside from Assembly, should I learn C or C++?

With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
-1
votes
1answer
285 views

how can one cause heap memory buffer overflow in a worker process by using a specially crafted request? [closed]

i am to web applications so i have recently published my website and ran a penetration test using Acunetix Vulnerability scanner so i have found the following result and for me to experience a lot ...
-1
votes
1answer
606 views

Extracting Opcodes of a binary

I want to extract opcodes 'Assembly instructions' from malware binaries . and because I have large number of samples I don't want to do it invidiously .. instead I want to automate the process of ...
-2
votes
4answers
1k views

Does learning Metasploit help me in reverse engineering and malware analysis?

I learned basis of assembly language with, both, AT&T and Intel style. After that I gone through buffer overflow and how to use shellcode with it. Should I go for Metasploit now?
-2
votes
1answer
780 views

How do anti-virus programs catch a virus? How they detect it? [closed]

I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?
-2
votes
1answer
975 views

How does this test for debugger [closed]

While reading a book it mentioned that the following code is usually used to as an antidebugger mov eax, large fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] retn I don't ...
-2
votes
2answers
478 views

How can I export only the mnemonics from objdump (or any other program)?

I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this? In other words of this output of objdump (objdump -d ...
-2
votes
1answer
92 views

Need help in understanding the code of a “Malicious” file [closed]

I'm testing a malware sample : hxxps://www.virustotal.com/en/file/55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd/analysis/ This is a malicious executable file. When executed in ...
-2
votes
1answer
586 views

How rootkits hide services on kernel mode? [closed]

How rootkits hide services on kernel mode? thanks
-2
votes
1answer
81 views

Malware static rules? [closed]

Is there any sites to get static rules to detect malware files? static behavior rules for detecting malware files. Thanks in advance.
-3
votes
1answer
307 views

What are the risks of running a decompiler? [closed]

I have a binary file which is potentially a virus and I wish to look into its internals. I need to be cautious as I don't want it to run on my system. That's why I ruled out gdb. I've searched and ...
-4
votes
2answers
3k views

Anti-debug techniques for MS-Windows?

Is there any anti-debugger tricks used by malware other than interrupt INT 0x2D ? And, how do they work ? Working examples would be really nice !