Hot answers tagged

18

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------+-----------+ | Instruction prefixes | Opcode | ModR/M | SIB | Displacement | Immediate | +----------------------+--------+--------+-----+--------------+-------...


17

It is important to understand that PEiD could potentially be identifying the wrong version of Delphi. While Delphi 6/7 are very similar (and frankly, all the way up to Delphi 2007 are very similar), you may be looking at a binary created with Delphi 2009 or newer. This is relevant because Delphi 2009 introduced native unicode string support and mapped the ...


14

To be a malware analyst, the minimum knowledge typically needed is: Assembly language Operating system internals Deobfuscation and anti-anti-debugging techniques Obviously, there are other useful areas of knowledge for malware analysis (like an understanding of network protocols, exploit analysis techniques, knowledge of VB P-code and JavaScript and .NET ...


14

You cannot step into kernel mode from Ollydbg. You need a kernel debugger like windbg, as ollydbg is a user mode debugger. Since you posed the question, I assume you neither have a kernel debugging connection, nor the driver where that control code is sent for analyzing it, as answered by Jonathon. Usage of proper security measures to deal with malware ...


13

Seeing a call in the form CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> suggests that the binary was compiled with Visual C++'s /INCREMENTAL option, hence the table of jump thunks. ... an incrementally linked executable (.exe) file or dynamic-link library (DLL): ... May contain jump thunks to handle relocation of functions to new ...


13

In C, and many other low-level programming languages the term NULL is equivalent to 0. The C standard requires NULL to be #defined to an "implementation defined value", however all implementations have chosen (for obvious reasons) to use 0 for that purpose. For that reason if you'll attempt to "See definition" for NULL, many IDEs will ...


11

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely similar to encryption. Encryption algorithms are divided into two classes. First is a stream cipher. From wikipedia: A stream cipher is a symmetric key cipher where ...


10

Have a look at this answer. It includes beginner malware training videos. Not familiar with malware myself, I do often see the following books recommended in answers: Malware Analyst's Cookbook Security professionals will find plenty of solutions in this book to the problems posed by viruses, Trojan horses, worms, spyware, rootkits, adware, and other ...


10

The most typical methods to detect a malware are the following: Streams of bytes. As simple as it sounds: find some specific string(s) or stream of bytes. Hashes. Either CRCs or similar to CRC hashes applied to some block of bytes like a section's data inside an executable file (i.e., a PE or ELF file) or the entry point. Each AV engine uses a different "...


10

The shellcode is unicode escaped. You can convert it to its hex representation using a simple python script. from binascii import unhexlify as unhx encoded = open('encoded.txt').read() # The shellcode dump out = open('shellcode.bin', 'wb') for s in encoded.split('%'): if len(s) == 5: HI_BYTE = s[3:] LO_BYTE = s[1:3] out.write(...


9

More specifically, it sounds like your executable is loading a Device Driver. Userspace executables often communicates with drivers via IOCTLs (or I/O Controls). DeviceIoControl does just that: sends an IOCTL to the driver. Note the second parameter to this function: DWORD dwIoControlCode. This is the code that identifies which IOCTL the program is ...


9

Googling for 0x50435245 gives several hits, for example here: /* Magic number to provide a small check against being handed junk. Also used to detect whether a pattern was compiled on a host of different endianness. */ #define MAGIC_NUMBER 0x50435245UL /* 'PCRE' */ <...snip...> /* The real format of the start of the pcre block; the index of ...


9

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the detector performs very naive checks to detect the compiler/linker/protector/etc which based on a preset mask of bytes. The mask is combined from a sequence of bytes ...


8

Different AV vendors use different naming conventions. Many of them describe these conventions on their websites. For example: http://www.microsoft.com/security/portal/mmpc/shared/malwarenaming.aspx http://www.symantec.com/security_response/virusnaming.jsp http://www.avira.com/en/support-malware-naming-conventions AV vendors will sometimes try to use the ...


8

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location. ImageBase: The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, ...


7

The syntax is incorrect, but the code is basically what IsDebuggerPresent does. Get a pointer to the TEB (located at fs:18h) Get a pointer to the PEB (located at teb+30h) Check the BeingDebugged flag (located at peb+2) The syntax should be something like: mov eax, large fs:18h mov eax, [eax+30h] movzx eax, byte ptr [eax+2] If you don't ...


7

For an executable with a digital certificate, it's easy enough to check for the certificate's information and origin by looking at the executable's properties. For example, here's what is shown for Skype: These certificates are issued to a developer from a trusted Certification Authority (CA) and are used to sign the executable before distributing it. In ...


7

This is an indirect answer to your question, but hopefully still useful. There are multiple conferences that feature state-of-the-art work in this space. If anyone knows of more, feel free to add on to this list. (links are to the archives of the conferences, whenever possible) Infiltrate OffensiveCon Videos are posted on their YouTube channel RECon ...


6

IDA supports remote debugging, see this guide on how to configure it : https://www.hex-rays.com/products/ida/support/freefiles/remotedbg.pdf . I don't know if funcap works with remote debugging but the author mentions using it in Windbg mode for kernel debugging so I guess it should.


6

For some reason I have yet to determine, every effort to set a breakpoint on this module by name (fdisk.sys) is failing. The driver isn't loaded at bootup (at least, not at the point that I'm investigating right now). It's loaded by a module and then unloaded again fairly soon thereafter. I finally used a debugger (indside my VM) to step through the ...


6

Your mistake is that you put the breakpoint while being on the PUSHAD instruction (meaning it wasn't executed yet). I just unpacked the file, and this is how you do it: 1. Drop the file in Olly and find the PUSHAD instruction Simply do what you did before, and end up here: 2. Step once to skip the PUSHAD Now, you got everything pushed, and the ...


6

Even the free version of IDA Pro is worth having. Finding the general structure of an unknown binary is much easier with it than with anything else. If you have an unknown DLL, it will show you which exports it has, and looking at the assembly code helps you guess the parameters. In most cases, to debug a .dll, you'll want to write a small program to call ...


6

There is not a single paper or book that explains the art of unpacking. This is mainly due to all the different packers that require different techniques to unpack them. There are of course generic approaches that work on some packers but knowing when to use them is gained from experience. IMHO the best approach to learn unpacking is to follow along with ...


6

With a trace this is very easy. Follow the trace sequentially and: For the very 1st instruction, create a function object at the address of that very 1st instruction. For each call statement or push + ret, create a function object and add an edge from the current function to this function object. For each new call statement, create or reuse a function ...


6

IsDebuggerPresent is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for SetWindowsHookExA, so you will often see them in clean executables.


6

For learning purposes, I would recommend you the following Github projects to start with: Paranoid Fish by a0rtega https://github.com/a0rtega/pafish Al-Khaser v0.60 by Noteworthy https://github.com/LordNoteworthy/al-khaser or Colection by AlicanAkyol https://github.com/AlicanAkyol/sems Grab one you like, compile and analyze. In case you look for in ...


6

Knowing how things in C work under the hood will help you if you're familiar with C and use it as your primary programming language, otherwise it's perfectly fine to have x86 asm as your first programing language. If you want a better understanding of the relationship between C and x86 assembly, I recommend reading the 7th chapter of Hacker disassembling ...


6

I know of no collection of malware samples, focusing specifically on DGAs. However, there are some resources that generally concentrate on DGAs and may provide you enough pointers to identify a reasonable number of different samples yourself. There is Johannes Bader's github repository which features several reimplementations of DGAs found in malware, along ...


6

An additional source of such samples, which I don't know why nobody listed, is virustotal.com. It lets you execute what they call "ruleset" and "retrohunt" searches which are basically running yara rules on every sample processed through virustotal and every sample from the last 3 months. This is a paid service but it's definitely worth it. Here's an image ...


6

Here are a few links that address your question in a broad manner: VMAttack: Deobfuscating Virtualization-Based Packed Binaries Link to PDF Paper which uses the VMAttack IDA PRO Plugin. Unpacking Virtualization Obfuscators by Rolf Rolles. Unpacking the FinSpy VM, parts #1, #2, #3 Various other articles by Rolf Rolles .


Only top voted, non community-wiki answers of a minimum length are eligible