I am the author of JSDetox, thanks to Jurriaan Bremer for mentioning it!
As already said every obfuscation scheme is different. JSDetox does not try to deobfuscate everything automatically - the main purpose is to support manual analysis.
It has two main features: static analysis tries to optimize code that is "bloated up", e.g. statements like
You can use the Image File Execution Options registry key to specify a debugger which will be launched automatically when the executable starts.
You can also always do the ancient trick of patching an endless loop (EB FE) at the entry point or somewhere later. This would allow you to attach at you leisure, restore the patched bytes and resume the execution.
You may start to look from your junk email folder and antivirus quarantine.
If you need something in particular, you may try to grab them live, from URLs posted by other researchers, and after you find something you want to share, add there too.
Here is a list I created once for my readers:
Malware Domain List
Malekal.com list of malware
You should proceed in two steps:
First: You need to have a look on MoonSols Windows Memory Toolkit Community Edition. It will allow You to dump memory to file for further analysis
Second: then You'll need Volatility Toolkit to analyze dump file and extract info, binaries, DLLs and more from there.
For great sample: of using Volatility - have a look on ...
To better understand this, you need to study instruction encoding formats i.e. x86 for this question.
An x86 instruction looks like this
| Instruction prefixes | Opcode | ModR/M | SIB | Displacement | Immediate |
Here's a tutorial using Malzilla to decode a LuckySploit attack.
You can download the pre-built binary for Malzilla on SourceForge, here.
From my "Ultimate" Anti-Debugging reference (see pferrie.host22.com):
The interrupt 0x2D is a special case. When it is executed, Windows uses the current EIP register value as the exception address, and then it increments by one the EIP register value. However, Windows also examines the value in the EAX register to determine how to adjust the exception ...
virtualizers usage in the wild
They are rarely used, and even worse (or better), rarely used in a useful way.
how they're used
Typically, it was the use of a virtualizer of over only the main function, or another binary packer, and both cases don't prevent analysis: if you bypass the virtualized packer code, then you get the original unpacked code anyway.
Binary packers alter the original binary data, and restore it (more or less) before execution.
Their different names depend more on their characteristic: it's difficult to clearly distinguish, as just putting an anti-debug and a Xor loop would make a packer also a protector and a cryptor.
extra packer code is executed
It is important to understand that PEiD could potentially be identifying the wrong version of Delphi. While Delphi 6/7 are very similar (and frankly, all the way up to Delphi 2007 are very similar), you may be looking at a binary created with Delphi 2009 or newer.
This is relevant because Delphi 2009 introduced native unicode string support and mapped the ...
To be a malware analyst, the minimum knowledge typically needed is:
Operating system internals
Deobfuscation and anti-anti-debugging techniques
You cannot step into kernel mode from Ollydbg. You need a kernel debugger like windbg, as ollydbg is a user mode debugger.
Since you posed the question, I assume you neither have a kernel debugging connection,
nor the driver where that control code is sent for analyzing it, as answered by Jonathon.
Usage of proper security measures to deal with malware ...
Both, DllMain and DllEntryPoint are merely symbolic names of the same concept. They even share the same prototype. But they aren't the same:
The function must be defined with the __stdcall calling convention.
The parameters and return value must be defined as documented in the
Win32 API for WinMain (for an .exe file) or DllEntryPoint (for a DLL).
Seeing a call in the form CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> suggests that the binary was compiled with Visual C++'s /INCREMENTAL option, hence the table of jump thunks.
... an incrementally linked executable (.exe) file or dynamic-link library (DLL):
May contain jump thunks to handle relocation of functions to new ...
In C, and many other low-level programming languages the term NULL is equivalent to 0.
The C standard requires NULL to be #defined to an "implementation defined value", however all implementations have chosen (for obvious reasons) to use 0 for that purpose. For that reason if you'll attempt to "See definition" for NULL, many IDEs will ...
DllEntryPoint - is the address from which the execution will start (but does not have to if we are speaking about malware) after the loader had finished the loading process of the PE image. This address is specified inside the PE optional header. Please look here. The other name for DllEntryPoint is AddressOfEntryPoint.
DllMain - is the default function ...
Short answer: AV scanners does not use signatures for polymorphic samples. They use generic detection code.
Long answer: Polymorphic malware makes the code look different for different generations. Talking about file infectors (Sality and Virut), a generation is considered when a new file is infected. If sample A infects B, C and D, then this is the 1st ...
The malware can propagate from the VM to the host in several circumstances:
If there's a bug in the VM software. That's not very common, but it's possible.
If there's a bug in the host OS. A bug that specifically allows malware to break out of a VM is unlikely but again possible.
If there's a bug in the processor. That's even more unlikely but still not ...
Your best bet is to use an environment (eg FireFox) in which eval() can be overridden by using a proxy function, and the function just prints the output. That way, there is no risk in missing anything, even if the malware aliases it. Unfortunately, eval() is not designed to be overridden (and I believe is explicitly forbidden by recent ECMAScript spec), ...
When single-stepping through code, the T flag is set so that the CPU can break after the instruction completes execution. When an interrupt occurs, the state of the T flag is placed on the stack, and used when the iret instruction is executed by the handler. However, the iret instruction is one of a few instructions that causes a one-instruction delay in ...
There are many kinds of polymorphic viruses, but generally most common solutions actually try to work around the problem and avoid detecting unknown samples on the users' machines. It's considered hard to detect viruses in real time on a live machine with little available resources without actually exposing the user to the malicious properties of the virus. ...
TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely similar to encryption.
Encryption algorithms are divided into two classes. First is a stream cipher. From wikipedia:
A stream cipher is a symmetric key cipher where ...
There are a couple options when it comes to getting samples for analysis.
This one is extremely common and is what is used by a lot of researches to build sample databases.
Recommendation: You could build your own scraper of common sources or build upon ones like:
Other researches will at times ...
Have a look at this answer. It includes beginner malware training videos.
Not familiar with malware myself, I do often see the following books recommended in answers:
Malware Analyst's Cookbook
Security professionals will find plenty of solutions in this book to the problems posed by viruses, Trojan horses, worms, spyware, rootkits, adware, and other ...
The most typical methods to detect a malware are the following:
Streams of bytes. As simple as it sounds: find some specific string(s) or stream of bytes.
Hashes. Either CRCs or similar to CRC hashes applied to some block of bytes like a section's data inside an executable file (i.e., a PE or ELF file) or the entry point. Each AV engine uses a different "...
The shellcode is unicode escaped. You can convert it to its hex representation using a simple python script.
from binascii import unhexlify as unhx
encoded = open('encoded.txt').read() # The shellcode dump
out = open('shellcode.bin', 'wb')
for s in encoded.split('%'):
if len(s) == 5:
HI_BYTE = s[3:]
LO_BYTE = s[1:3]
No absolutely reliable way, no.
Either way you'll need a full dump, but the problem is that malware could even hook the responsible functions inside the kernel and modify what gets dumped. There are several things that have to be considered here.
You can detect it if the malware used a trivial method for hooking in the first place. Let's assume the address ...
Well, after online tools, You may use Revelo by KahuSecurity
It's have less automation in process, but more powerful in de-obfuscation of customized js.
Documentation is included in ZIP, you also may see examples of it's usage in Kahu blog as well:
p.s. don't forget to use VM!
Basically, all DLLs listed in that reg-key are loaded when any process is started.
For more info see Working with the AppInit_DLLs registry value.
All the DLLs that are specified in this value are loaded by each Microsoft Windows-based application that is running in the current log on session.
They are usually used by malicious code (tho it doesn't have ...
I would suggest this as a solution http://accessroot.com/arteam/site/download.php?view.185 as I had similar problem in one of crackmes. What I did was to write my own hooks for SoftICE to bypass ring0 hooks of int 3 and int 1. Could be useful for your problem. Interesting section is "SoftICE comes to the rescue".