Table of Contents for

Practical Malware Analysis

A

A, at end of Windows function name, Exploring Dynamically Linked Functions with Dependency Walker

absolute addresses, Rebasing, Differences in x64 Architecture

vs. relative addresses, in OllyDbg, Rebasing

abstraction levels, in x86 disassembly, Levels of Abstraction

accept function, Berkeley Compatible Sockets, The Server and Client Sides of Networking, Important Windows Functions

access token, Privilege Escalation

accuracy, vs. expediency, Intrusion Detection with Snort

active window, logging, User-Space Keyloggers

ADD encoding algorithm, Identifying XOR Loops in IDA Pro

add instruction, Simple Instructions, Thwarting Stack-Frame Analysis

AddCodeXref function (IDC), Adding Missing Code Cross-References in IDA Pro

address space layout randomization (ASLR), Rebasing

address space, loading executable into another process’s, Detailed Analysis

AddressOfNameOrdinals array, Parsing PE Export Data

AddressOfNames array, Parsing PE Export Data

AdjustTokenPrivileges function, Privilege Escalation, Using SeDebugPrivilege, Important Windows Functions, Detailed Analysis

administrator privileges, for malware launchers, Launchers

Adobe Reader, Finding Shellcode, Detailed Analysis

CVE-2010-0188 critical vulnerability, Finding Shellcode

overflow in, Detailed Analysis

ADS (Alternate Data Streams) feature, The Windows Registry

Advanced Encryption Standard (AES), Short Answers, Modified Base64 Decoding

decrypting, Modified Base64 Decoding

advapi32.dll, Exploring Dynamically Linked Functions with Dependency Walker, PotentialKeylogger.exe: An Unpacked Executable, Hash Dumping, Detailed Analysis, Short Answers

imports from, PotentialKeylogger.exe: An Unpacked Executable, Detailed Analysis, Short Answers

obtaining handle to, Hash Dumping

advertisements, pop-up, Recovering the Hidden File

AES (Advanced Encryption Standard), Short Answers, Modified Base64 Decoding

decrypting, Modified Base64 Decoding

Agobot, Querying the I/O Communication Port

air-gapped networks, Malware Analysis in Virtual Machines

_alloca_probe function, Analyzing the DLL

alphabetic encoding, shellcode decoder with, Detailed Analysis

Alternate Data Streams (ADS) feature, The Windows Registry

ALU (arithmetic logic unit), Reverse-Engineering

AMD64 architecture, 64-Bit Malware

“Analysis of the Intel Pentium’s Ability to Support a Secure Virtual Machine Monitor” (Robin and Irvine), Bypassing VMware Artifact Searching

AND logical operator, in x86 architecture, Arithmetic

anti-debugging, Anti-Debugging, Lab 16-1, Detailed Analysis, Detailed Analysis, The BeingDebugged Flag, The BeingDebugged Flag, The ProcessHeap Flag, The ProcessHeap Flag, The NTGlobalFlag Flag, Detailed Analysis, The QueryPerformanceCounter Function, The QueryPerformanceCounter Function, The GetTickCount Function

checks, Detailed Analysis

defeating techniques, The NTGlobalFlag Flag

labs, Lab 16-1, Detailed Analysis

solutions, Detailed Analysis

NTGlobalFlag flag, The ProcessHeap Flag

PhantOm protection from checks, The BeingDebugged Flag, The ProcessHeap Flag

ProcessHeap flag, The BeingDebugged Flag

timing checks, Detailed Analysis, The QueryPerformanceCounter Function, The QueryPerformanceCounter Function, The GetTickCount Function

GetTickCount function, The QueryPerformanceCounter Function

rdtsc function, The GetTickCount Function

with QueryPerformanceCounter, The QueryPerformanceCounter Function

anti-disassembly, Anti-Disassembly, Anti-Disassembly, Understanding Anti-Disassembly, Understanding Anti-Disassembly, Linear Disassembly, Flow-Oriented Disassembly, Flow-Oriented Disassembly, A Jump Instruction with a Constant Condition, A Jump Instruction with a Constant Condition, Impossible Disassembly, Impossible Disassembly, Impossible Disassembly, Impossible Disassembly, Adding Missing Code Cross-References in IDA Pro, Adding Missing Code Cross-References in IDA Pro, Misusing Structured Exception Handlers, Thwarting Stack-Frame Analysis, Lab 15-1, Anti-Debugging, Web Commands, Web Commands, Web Commands, Short Answers, Detailed Analysis, Detailed Analysis

basics, Anti-Disassembly

defeating disassembly algorithms, Understanding Anti-Disassembly, Understanding Anti-Disassembly, Linear Disassembly

flow-oriented disassembly, Linear Disassembly

linear disassembly, Understanding Anti-Disassembly

false conditional branch, A Jump Instruction with a Constant Condition, Web Commands, Short Answers, Detailed Analysis

labs, Lab 15-1, Web Commands

solutions, Web Commands

malware awareness of debugger, Anti-Debugging

manually repaired code, Detailed Analysis

obscuring flow control, Impossible Disassembly, Impossible Disassembly, Adding Missing Code Cross-References in IDA Pro, Adding Missing Code Cross-References in IDA Pro, Misusing Structured Exception Handlers

adding missing code cross-references in IDA Pro, Adding Missing Code Cross-References in IDA Pro

function pointer problem, Impossible Disassembly

misusing structured exception handlers, Misusing Structured Exception Handlers

return pointer abuse, Adding Missing Code Cross-References in IDA Pro

signs of, Web Commands

techniques, Flow-Oriented Disassembly, Flow-Oriented Disassembly, A Jump Instruction with a Constant Condition, Impossible Disassembly, Impossible Disassembly

impossible disassembly, Impossible Disassembly

jump instruction with constant condition, A Jump Instruction with a Constant Condition

jump instructions with same target, Flow-Oriented Disassembly

NOP-ing out instructions with IDA Pro, Impossible Disassembly

thwarting stack-frame analysis, Thwarting Stack-Frame Analysis

anti-virtual machine (anti-VM) techniques, Anti-Virtual Machine Techniques, Anti-Virtual Machine Techniques, Bypassing VMware Artifact Searching, Vulnerable Instructions, Using the Red Pill Anti-VM Technique, Using the Red Pill Anti-VM Technique, Querying the I/O Communication Port, Using ScoopyNG, Lab 17-1, Detailed Analysis, Short Answers, Short Answers, Short Answers, Short Answers, Searching for Vulnerable Instructions, Finding Anti-VM Techniques Using Strings

finding using strings, Searching for Vulnerable Instructions

highlighting anti-VM in IDA Pro, Querying the I/O Communication Port

impact on malware analysis, Short Answers

labs, Lab 17-1, Short Answers

solutions, Short Answers

process replacement, Finding Anti-VM Techniques Using Strings

tweaking settings, Using ScoopyNG

VMware artifacts, Anti-Virtual Machine Techniques

vulnerable instructions, Bypassing VMware Artifact Searching, Vulnerable Instructions, Using the Red Pill Anti-VM Technique, Using the Red Pill Anti-VM Technique, Short Answers

No Pill technique, Using the Red Pill Anti-VM Technique

querying I/O communication port, Using the Red Pill Anti-VM Technique

Red Pill anti-VM technique, Vulnerable Instructions

antivirus programs, and kernel patching, Kernel Issues for Windows Vista, Windows 7, and x64 Versions

antivirus scanning, Antivirus Scanning: A Useful First Step

antivirus signatures, scan against, Short Answers

Anubis, Basic Dynamic Analysis

ApateDNS, Comparing Registry Snapshots with Regshot, Basic Dynamic Tools in Practice, Tools for Malware Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis

malware DNS requests and, Detailed Analysis

APC (asynchronous procedure call), APC Injection

APC injection, Detours

AppInit_DLLs, Identifying Keyloggers in Strings Listings, Detailed Analysis, Detailed Analysis

for persistence, Detailed Analysis

applications, access to device objects, Drivers and Kernel Code

arguments in malware, OllyDbg to debug, Detailed Analysis

arithmetic instruction, Simple Instructions

arithmetic logic unit (ALU), Reverse-Engineering

arithmetic operations, Disassembling Arithmetic Operations, Reading from Memory

disassembly, Disassembling Arithmetic Operations

in WinDbg, Reading from Memory

arrays, disassembling, Disassembling Arrays

arrows window, in IDA Pro, Graph Mode

The Art of Assembly Language (Hyde), Reverse-Engineering

ASCII strings, Finding Strings, Detailed Analysis

loading on stack, Detailed Analysis

ASLR (address space layout randomization), Rebasing

ASPack, PECompact

assembly code, for process replacement, Process Replacement

assembly language, Levels of Abstraction, Disassembling Arithmetic Operations, Finding for Loops, Understanding Function Call Conventions, Jump Table

(see also C code constructs in assembly)

for loop, Finding for Loops

if statement, Disassembling Arithmetic Operations

switch statement, Jump Table

while loop, Understanding Function Call Conventions

assembly-level debuggers, vs. source level, Debugging

asynchronous procedure call (APC), APC Injection

AttachThreadInput function, Important Windows Functions

attackers, Indications of Malicious Activity, OPSEC = Operations Security

identifying investigative activity, Indications of Malicious Activity

safely investigating online, OPSEC = Operations Security

AT_INFO structure, Using the Memory Map to Locate DLLs

Autoruns tool, Common Registry Functions, Identifying Keyloggers in Strings Listings, Tools for Malware Analysis