Table of Contents for

Practical Malware Analysis

B

backdoor, Basic Dynamic Analysis, Using a Malware Sandbox, If Style, Downloaders and Launchers, Combining Dynamic and Static Analysis Techniques, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Analyzing the DLL, Command-Line Option Analysis, Backdoor Analysis, Networking Analysis, Detailed Analysis

analysis, Command-Line Option Analysis

CreateProcess and Sleep functions for, Detailed Analysis

evading detection, Combining Dynamic and Static Analysis Techniques

HTTP reverse, Networking Analysis

implementing, Analyzing the DLL

indications of, Detailed Analysis

reading configuration file, Detailed Analysis

sandbox and, Using a Malware Sandbox

backup images, of operating systems, Malware Analysis in Virtual Machines

“Bad or Unknown 32-bit Executable File” error, Inserting INT 3

bang symbol (!), Taking a Deeper Look

base addresses, Rebasing, Finding kernel32.dll in Memory, Short Answers

finding with PEview, Short Answers

for PE files in Windows, Rebasing

of kernel32.dll, finding with assembly code, Finding kernel32.dll in Memory

Base64 cipher, Other Simple Encoding Schemes, Transforming Data to Base64, Identifying and Decoding Base64, Detailed Analysis

custom substitution cipher, Identifying and Decoding Base64

identifying and decoding, Transforming Data to Base64

Base64 encoding, Self-Decoding, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Network Signatures

decoding, Detailed Analysis

identifying in URL, Detailed Analysis

padding, Detailed Analysis, Detailed Analysis

Python program to decode string, Self-Decoding

static pattern within, Network Signatures

base64_encode function, Detailed Analysis

basename, Detailed Analysis

BCDEdit, Kernel Issues for Windows Vista, Windows 7, and x64 Versions

beaconing, Hiding in Plain Sight, Attackers Use Existing Infrastructure, Detailed Analysis, Short Answers, Detailed Analysis, Short Answers, Detailed Analysis, Short Answers, Detailed Analysis

client-initiated, Attackers Use Existing Infrastructure

determining generation, Detailed Analysis

packet structure, Detailed Analysis

request from initial malware run, Short Answers

sending by malware, Short Answers, Short Answers

string decoding, Detailed Analysis

beep driver, Viewing Structure Information

behavior of malware, Malware Behavior (see malware behavior)

BeingDebugged flag, Using the Windows API, Checking the BeingDebugged Flag, Detailed Analysis

checking, Using the Windows API

Berkeley compatible sockets, Berkeley Compatible Sockets

BFK DNS logger, Getting IP Address and Domain Information

BHOs (Browser Helper Objects), CLSIDs, IIDs, and the Use of COM Objects

big-endian, Instructions

binary data, Other Simple Encoding Schemes, Detailed Analysis

Base64-encoding conversion, Other Simple Encoding Schemes

static analysis, Detailed Analysis

Binary File option, in IDA Pro, IDA Pro

binary translation by VMware, in kernel mode, Bypassing VMware Artifact Searching

bind function, Berkeley Compatible Sockets, The Server and Client Sides of Networking, Important Windows Functions

BinDiff, Tools for Malware Analysis

BinNavi, Tools for Malware Analysis

BitBlaze, Basic Dynamic Analysis

BitBlt function, Important Windows Functions

blacklists, of IP addresses, Getting IP Address and Domain Information

Blink pointers, Finding kernel32.dll in Memory

block cryptography algorithms, Decrypting AES

blue screen, in Windows, Exceptions: When Things Go Wrong

Bochs (debugger), Tools for Malware Analysis

Bookmarks plug-in, in OllyDbg, Command Line

boot.ini file, Drivers and Kernel Code, Loading Drivers

botnet controller, RATs

botnets, Basic Dynamic Analysis, RATs, Querying the I/O Communication Port

bp command, in WinDbg, Reading from Memory

branching, in x86 architecture, Stack Layout

breakpoints, Stepping-Over vs. Stepping-Into, Pausing Execution with Breakpoints, Software Execution Breakpoints, Hardware Execution Breakpoints, Breakpoints, Command Line, Reading from Memory, Setting Breakpoints, Self-Decoding, INT Scanning, INT Scanning, Rebuilding the Import Table with Import Reconstructor, Applying a Structure in IDA Pro, Analyzing Lab10-01.sys in WinDbg, Lab 18-3 Solutions, Lab 18-4 Solutions

and self-decoding, Self-Decoding

deferred, Setting Breakpoints, Analyzing Lab10-01.sys in WinDbg

for kernel activity, Applying a Structure in IDA Pro

hardware vs. software, Lab 18-3 Solutions

in debuggers, Stepping-Over vs. Stepping-Into, Pausing Execution with Breakpoints, Software Execution Breakpoints, Hardware Execution Breakpoints

conditional, Hardware Execution Breakpoints

hardware execution, Software Execution Breakpoints

software execution, Pausing Execution with Breakpoints

in OllyDbg, Breakpoints, Command Line, Rebuilding the Import Table with Import Reconstructor

command-line to set, Command Line

in WinDbg, Reading from Memory

scanning code for, INT Scanning

setting, INT Scanning

setting on stack, Lab 18-4 Solutions

bridged network adapter, Using Your Malware Analysis Machine

Browser Helper Objects (BHOs), CLSIDs, IIDs, and the Use of COM Objects

brute-force XOR encoding, XOR

bu $iment command, in WinDbg, Searching for Symbols, Analyzing Lab10-01.sys in WinDbg

bu command, in WinDbg, Setting Breakpoints

buffer, malware placement of value in, Backdoor Analysis

buffer-overflow attack, A Full Hello World Example

Burp Suite, Tools for Malware Analysis

Buster Sandbox Analyzer, Tools for Malware Analysis

byte array initialization, Finding Anti-VM Techniques Using Strings

bytecode, Levels of Abstraction