There's a number of interesting resources you can get malware from
The premier Malware sample dump Contagio
KernelMode.info (Focuses on Win32 and novel rootkit techniques)
DamageLab.org (People occassionally will post their unpacked executables here, which differ from 'in the wild' executables they are seeking to drop on victim's computers, but interesting ...
The title mentions "sandbox" but VMWare or QEMU is usually not called that, so the question seems to be more about "how do I analyze it without a danger of infection?"
There are three broad categories of tools and approaches you could take here.
1. User-mode sandboxes
A user-mode sandbox basically runs the sample being investigated but intercepts all or ...
I am the author of JSDetox, thanks to Jurriaan Bremer for mentioning it!
As already said every obfuscation scheme is different. JSDetox does not try to deobfuscate everything automatically - the main purpose is to support manual analysis.
It has two main features: static analysis tries to optimize code that is "bloated up", e.g. statements like
There are many great options to get malware samples in all the comments but, also, I want to point you to 2 more options:
Open Malware. This is the new site for the old Offensive Computing.
I used to host a MalwareURLs list on My Blog but it seems to be down ATM. I'll update with a new URL as soon as it's back up.
I use VirusShare.com, which has about 5.6 million samples. You will need to request access, but I just explained the research I was doing (as a person unaffiliated with any organisation) and they let me in.
Your question mentioned downloading in bulk. The site says:
Want more than a few samples? Want to download really large samples of malware? Want to ...
You can use the Image File Execution Options registry key to specify a debugger which will be launched automatically when the executable starts.
You can also always do the ancient trick of patching an endless loop (EB FE) at the entry point or somewhere later. This would allow you to attach at you leisure, restore the patched bytes and resume the execution.
I'd suggest Malware.lu. The website writes (as of 2013-03-23):
Currently the database contains 5,356,052 samples.
First you have to request an account. The website lists an email address. You can send a few words why you want to have an account there. After some time they send you your login data.
You can access the data through the website, but they ...
You may start to look from your junk email folder and antivirus quarantine.
If you need something in particular, you may try to grab them live, from URLs posted by other researchers, and after you find something you want to share, add there too.
Here is a list I created once for my readers:
Malware Domain List
Malekal.com list of malware
Bochs if you don't need speed but lots of flexibility. You can use Bochs with GDB.
Qemu if you need more speed and less flexibility (it does dynamic translation so you gain bit of speed but lose the acutal sequence of the instructions) possibly a bit less safe than bochs. Its similar to Vmware and virtualbox actually derives from it. You can use GDB with ...
You should proceed in two steps:
First: You need to have a look on MoonSols Windows Memory Toolkit Community Edition. It will allow You to dump memory to file for further analysis
Second: then You'll need Volatility Toolkit to analyze dump file and extract info, binaries, DLLs and more from there.
For great sample: of using Volatility - have a look on ...
To better understand this, you need to study instruction encoding formats i.e. x86 for this question.
An x86 instruction looks like this
| Instruction prefixes | Opcode | ModR/M | SIB | Displacement | Immediate |
Here's a tutorial using Malzilla to decode a LuckySploit attack.
You can download the pre-built binary for Malzilla on SourceForge, here.
virtualizers usage in the wild
They are rarely used, and even worse (or better), rarely used in a useful way.
how they're used
Typically, it was the use of a virtualizer of over only the main function, or another binary packer, and both cases don't prevent analysis: if you bypass the virtualized packer code, then you get the original unpacked code anyway.
From my "Ultimate" Anti-Debugging reference (see pferrie.host22.com):
The interrupt 0x2D is a special case. When it is executed, Windows uses the current EIP register value as the exception address, and then it increments by one the EIP register value. However, Windows also examines the value in the EAX register to determine how to adjust the exception ...
Binary packers alter the original binary data, and restore it (more or less) before execution.
Their different names depend more on their characteristic: it's difficult to clearly distinguish, as just putting an anti-debug and a Xor loop would make a packer also a protector and a cryptor.
extra packer code is executed
It is important to understand that PEiD could potentially be identifying the wrong version of Delphi. While Delphi 6/7 are very similar (and frankly, all the way up to Delphi 2007 are very similar), you may be looking at a binary created with Delphi 2009 or newer.
This is relevant because Delphi 2009 introduced native unicode string support and mapped the ...
Gilles provided some great links and I want to discuss the use a virtual machines for malware analysis a bit more. While a VM breakout certainly is a possibility, I have yet to come across such a case or even heard about one and I assume this would make some buzz should someone find one. To be safe, simply run your VM software on an isolated computer and ...
To be a malware analyst, the minimum knowledge typically needed is:
Operating system internals
Deobfuscation and anti-anti-debugging techniques
You cannot step into kernel mode from Ollydbg. You need a kernel debugger like windbg, as ollydbg is a user mode debugger.
Since you posed the question, I assume you neither have a kernel debugging connection,
nor the driver where that control code is sent for analyzing it, as answered by Jonathon.
Usage of proper security measures to deal with malware ...
Both, DllMain and DllEntryPoint are merely symbolic names of the same concept. They even share the same prototype. But they aren't the same:
The function must be defined with the __stdcall calling convention.
The parameters and return value must be defined as documented in the
Win32 API for WinMain (for an .exe file) or DllEntryPoint (for a DLL).
Seeing a call in the form CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> suggests that the binary was compiled with Visual C++'s /INCREMENTAL option, hence the table of jump thunks.
... an incrementally linked executable (.exe) file or dynamic-link library (DLL):
May contain jump thunks to handle relocation of functions to new ...
DllEntryPoint - is the address from which the execution will start (but does not have to if we are speaking about malware) after the loader had finished the loading process of the PE image. This address is specified inside the PE optional header. Please look here. The other name for DllEntryPoint is AddressOfEntryPoint.
DllMain - is the default function ...
Short answer: AV scanners does not use signatures for polymorphic samples. They use generic detection code.
Long answer: Polymorphic malware makes the code look different for different generations. Talking about file infectors (Sality and Virut), a generation is considered when a new file is infected. If sample A infects B, C and D, then this is the 1st ...
The malware can propagate from the VM to the host in several circumstances:
If there's a bug in the VM software. That's not very common, but it's possible.
If there's a bug in the host OS. A bug that specifically allows malware to break out of a VM is unlikely but again possible.
If there's a bug in the processor. That's even more unlikely but still not ...
In C, and many other low-level programming languages the term NULL is equivalent to 0.
The C standard requires NULL to be #defined to an "implementation defined value", however all implementations have chosen (for obvious reasons) to use 0 for that purpose. For that reason if you'll attempt to "See definition" for NULL, many IDEs will ...
Your best bet is to use an environment (eg FireFox) in which eval() can be overridden by using a proxy function, and the function just prints the output. That way, there is no risk in missing anything, even if the malware aliases it. Unfortunately, eval() is not designed to be overridden (and I believe is explicitly forbidden by recent ECMAScript spec), ...
There is also the option of putting out your own HoneyPot to capture live malware. This does take a bit of effort and some resources (purchasing Internet addressable IP address). However, the advantage of this method is that you are virtually guaranteed to capture malware that are actively being used currently in the wild. There is the possibility that you ...
When single-stepping through code, the T flag is set so that the CPU can break after the instruction completes execution. When an interrupt occurs, the state of the T flag is placed on the stack, and used when the iret instruction is executed by the handler. However, the iret instruction is one of a few instructions that causes a one-instruction delay in ...
There are many kinds of polymorphic viruses, but generally most common solutions actually try to work around the problem and avoid detecting unknown samples on the users' machines. It's considered hard to detect viruses in real time on a live machine with little available resources without actually exposing the user to the malicious properties of the virus. ...
TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely similar to encryption.
Encryption algorithms are divided into two classes. First is a stream cipher. From wikipedia:
A stream cipher is a symmetric key cipher where ...