Table of Contents for

Practical Malware Analysis

C

C code constructs in assembly, Recognizing C Code Constructs in Assembly, Recognizing C Code Constructs in Assembly, Disassembling Arithmetic Operations, Disassembling Arithmetic Operations, Finding for Loops, Finding for Loops, Understanding Function Call Conventions, cdecl, If Style, If Style, Jump Table, Jump Table, Disassembling Arrays, Identifying Structs, Analyzing Linked List Traversal, Questions, Detailed Analysis

arithmetic operations disassembly, Disassembling Arithmetic Operations

array disassembly, Disassembling Arrays

function call conventions, cdecl

global vs. local variables, Recognizing C Code Constructs in Assembly

if statements, Disassembling Arithmetic Operations

labs, Questions, Detailed Analysis

solutions, Detailed Analysis

linked list traversal, Analyzing Linked List Traversal

loops, Finding for Loops, Finding for Loops, Understanding Function Call Conventions

for loops, Finding for Loops

while loops, Understanding Function Call Conventions

structures, identifying, Identifying Structs

switch statements, If Style, If Style, Jump Table, Jump Table

if style for, If Style, Jump Table

jump table, Jump Table

C programming language, Rep Instructions, Using Named Constants, Recognizing C Code Constructs in Assembly, Process Replacement, Impossible Disassembly

function pointers in, Impossible Disassembly

main method and offsets, in x86 architecture, Rep Instructions

pseudocode for process replacement, Process Replacement

standard library, IDA Pro catalog of named constants, Using Named Constants

C++ analysis, C++ Analysis, C++ Analysis, Object-Oriented Programming, The this Pointer, Inheritance and Function Overriding, Inheritance and Function Overriding, Creating and Destroying Objects, Lab 20-1, Detailed Analysis

labs, Lab 20-1, Detailed Analysis

solutions, Detailed Analysis

object-oriented programming, C++ Analysis, Object-Oriented Programming, The this Pointer, Inheritance and Function Overriding

inheritance and function overriding, Inheritance and Function Overriding

overloading and mangling, The this Pointer

this pointer, Object-Oriented Programming

objects creation and destruction, Creating and Destroying Objects

virtual vs. nonvirtual functions, Inheritance and Function Overriding

Caesar cipher, The Goal of Analyzing Encoding Algorithms

call instruction, cdecl, Flow-Oriented Disassembly, The Tail Jump, Rebuilding the Import Table with Import Reconstructor, Repairing the Import Table Manually, Shellcode Analysis, Position-Independent Code, Detailed Analysis

and finding OEP, Rebuilding the Import Table with Import Reconstructor

for quick analysis, Detailed Analysis

position dependence, Shellcode Analysis

with target based on DWORD pointer, Repairing the Import Table Manually

call memory_location, The Stack

call stack trace, in OllyDbg, Standard Back Trace

callback type, Handles

calling conventions, x64 architecture differences, Differences in x64 Architecture

CallNextHookEx function, Local and Remote Hooks, Thread Targeting, Important Windows Functions

Canvas penetration-testing tool, Tweaking Settings

Capture BAT, Tools for Malware Analysis

capturing events, Monitoring with Process Monitor, Examining the Hook in OllyDbg

network traffic, Examining the Hook in OllyDbg

stopping procmon from, Monitoring with Process Monitor

capturing screen, function for, Detailed Analysis

CBC (Cipher Block Chaining), Decrypting AES

cdecl calling convention, cdecl

cell phone malware, IDA Pro

central processing unit (CPU), Reverse-Engineering, Creating a New Process

in x86 architecture, Reverse-Engineering

threads and, Creating a New Process

CertOpenSystemStore function, Important Windows Functions

CF (carry) flag, General Registers

CFB (Cipher Feedback), Decrypting AES

CFF Explorer, Tools for Malware Analysis

cfile.read command, Using Instrumentation for Generic Decryption

chained encoding algorithm, Other Simple Encoding Schemes

CheckRemoteDebuggerPresent function, Windows Debugger Detection, Important Windows Functions

child classes in C++, Inheritance and Function Overriding, Recognizing a Vtable

functions from parent class, Recognizing a Vtable

chunk size, dependency with entropy score, Searching for High-Entropy Content

Cipher Block Chaining (CBC), Decrypting AES

Cipher Feedback (CFB), Decrypting AES

ciphers, The Goal of Analyzing Encoding Algorithms, The Goal of Analyzing Encoding Algorithms, XOR, Identifying XOR Loops in IDA Pro, Other Simple Encoding Schemes

Base 64, Other Simple Encoding Schemes

Caesar cipher, The Goal of Analyzing Encoding Algorithms

other encoding schemes, Identifying XOR Loops in IDA Pro

XOR cipher, XOR

cisvc.exe, Detailed Analysis, Detailed Analysis

PEview of original and trojanized versions, Detailed Analysis

writing shellcode into, Detailed Analysis

class identifiers (CLSIDs), The Component Object Model, Detailed Analysis

and COM functionality, Detailed Analysis

classes, in object-oriented code, Object-Oriented Programming

classtype keyword, in Snort, Intrusion Detection with Snort

client side of network, The Server and Client Sides of Networking

client-initiated beaconing, Attackers Use Existing Infrastructure

client/server framework, Component Object Model as, Services

CloseHandle function, Analyzing the EXE

CloseServiceHandle function, Analyzing Lab10-01.sys in WinDbg

cloud services, OPSEC = Operations Security

Cloudburst, Tweaking Settings

CLSIDs (class identifiers), The Component Object Model, Detailed Analysis

and COM functionality, Detailed Analysis

cmd.exe, Reverse Shell Analysis

cmp instruction, Stack Layout, Thwarting Stack-Frame Analysis, Detailed Analysis

CoCreateInstance function, The Component Object Model, Understanding Surrounding Code, Important Windows Functions, Detailed Analysis

code, Main Memory, Using Named Constants, Understanding Surrounding Code, INT Scanning

in memory, Main Memory

performing checksums, INT Scanning

redefining in IDA Pro, Using Named Constants

understanding surrounding, Understanding Surrounding Code

code construct, Recognizing C Code Constructs in Assembly

code cross-references, Searching

code entry point, unpacking stub and, Packer Anatomy

code libraries, linking, Portable Executable File Format

COFF (Common Object File Format), IDA Pro support for, IDA Pro

CoInitialize function, Understanding Surrounding Code

CoInitializeEx function, Services

colors in IDA Pro navigation band, Using Links and Cross-References

COM (Component Object Model), Services, CLSIDs, IIDs, and the Use of COM Objects, Understanding Surrounding Code, Detailed Analysis, Decrypting AES

related functions, Detailed Analysis

server malware, CLSIDs, IIDs, and the Use of COM Objects

Command Line plug-in, for OllyDbg, Plug-ins, Detailed Analysis, The NTGlobalFlag Flag

launching, The NTGlobalFlag Flag

command processing, and malware signature, Web Commands

command shell, thread input to, Detailed Analysis

command-line, Jump to Location, Detailed Analysis, Analyzing the DLL, Analyzing the EXE, Detailed Analysis, Detailed Analysis

analysis of binary, Jump to Location

arguments in malware, Analyzing the EXE

check for arguments, Analyzing the DLL

encoded, Detailed Analysis

option analysis, Detailed Analysis

running malware from, Detailed Analysis

comments, Enhancing Disassembly, Detailed Analysis, Detailed Analysis, Detailed Analysis

in HTML, Detailed Analysis, Detailed Analysis, Detailed Analysis

command character parsed from, Detailed Analysis

to send commands to malware, Detailed Analysis

in IDA Pro, Enhancing Disassembly

Common Object File Format (COFF), IDA Pro support for, IDA Pro

Comodo Instant Malware Analysis, Basic Dynamic Analysis

comparing strings, in Process Explorer, Using the Verify Option

compilation, Levels of Abstraction

Component Object Model (COM), Services, CLSIDs, IIDs, and the Use of COM Objects, Understanding Surrounding Code, Detailed Analysis, Decrypting AES

related functions, Detailed Analysis

server malware, CLSIDs, IIDs, and the Use of COM Objects

compression algorithm, packers and, Packer Anatomy

compsb instruction, Rep Instructions

ComSpec environmental variable, Detailed Analysis

conditional branches, Flow-Oriented Disassembly, Thwarting Stack-Frame Analysis, Web Commands, Short Answers

false, Web Commands, Short Answers

flow-oriented disassembly and, Flow-Oriented Disassembly

conditional breakpoints, Hardware Execution Breakpoints, Breakpoints, Software Breakpoints

in OllyDbg, Breakpoints, Software Breakpoints

conditional jump, Stack Layout, Disassembling Arithmetic Operations, Finding for Loops, Checking the BeingDebugged Flag

conditionals, in x86 architecture, Stack Layout

configuration information, Windows Registry for, The Windows Registry

connect function, Berkeley Compatible Sockets, The Server and Client Sides of Networking, Understanding Surrounding Code, Important Windows Functions, Detailed Analysis

connect mode, in Netcat, Using ApateDNS

ConnectNamedPipe function, Important Windows Functions

console programs, IMAGE_SUBSYSTEM_WINDOWS_CUI value for, Examining PE Files with PEview

constructor, Creating and Destroying Objects

content keyword, in Snort, Intrusion Detection with Snort

content-based countermeasures, Network Countermeasures, Getting IP Address and Domain Information

control unit, Reverse-Engineering

ControlService function, Important Windows Functions, Short Answers

convention, General Registers

CopyFile function, Analyzing the EXE

countermeasures, Malware-Focused Network Signatures, Getting IP Address and Domain Information

content-based, Getting IP Address and Domain Information

network-based, Malware-Focused Network Signatures

covert launching techniques, Covert Malware Launching, Covert Malware Launching, Launchers, DLL Injection, Process Replacement, Detours, Detours, Lab 12-1, Summary

APC injection, Detours

Detours, Detours

hook injection, Process Replacement

labs, Lab 12-1, Summary

solutions, Summary

launchers, Covert Malware Launching

process injection, Launchers

process replacement, DLL Injection

CPU (central processing unit), Reverse-Engineering, Creating a New Process

in x86 architecture, Reverse-Engineering

threads and, Creating a New Process

cpuid instruction, virtual machine and, Vulnerable Instructions

crashing virtual machine, from procmon, Monitoring with Process Monitor

CreateFile function, File System Functions, Stepping-Over vs. Stepping-Into, Configuring Windows Symbols, Looking at the Kernel-Mode Code, Important Windows Functions, Detailed Analysis, Analyzing the EXE, Detailed Analysis, Detailed Analysis

debugger and, Stepping-Over vs. Stepping-Into

CreateFileMapping function, File System Functions, Important Windows Functions, Detailed Analysis, Analyzing the EXE, Detailed Analysis

CreateMutex function, Interprocess Coordination with Mutexes, Important Windows Functions, Analyzing the DLL

CreatePipe function, Netcat Reverse Shells

CreateProcess function, Basic DLL Structure, Netcat Reverse Shells, Important Windows Functions, Detailed Analysis, Analyzing the DLL, Reverse Shell Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis

parameters, Detailed Analysis

CreateRemoteThread function, DLL Injection, DLL Injection, DLL Injection, Detours, NOP Sleds, Important Windows Functions, Summary, Short Answers, Detailed Analysis, Detailed Analysis

and direct injection, DLL Injection

arguments for, Detailed Analysis

for DLL injection, DLL Injection

CreateService function, Services, SvcHost DLLs, Important Windows Functions, Detailed Analysis, Short Answers, Detailed Analysis, Analyzing Lab10-01.sys in WinDbg

CreateThread function, Creating a Thread

CreateToolhelp32Snapshot function, DLL Injection, APC Injection, Important Windows Functions, Detailed Analysis

CreateWindowEx function, File System Functions

credential stealers, RATs, GINA Interception, GINA Interception, Hash Dumping, Analysis of msgina32.dll

GINA interception, GINA Interception, Analysis of msgina32.dll

hash dumping, GINA Interception

keystroke logging, Hash Dumping

cross-references (xref), Useful Windows for Analysis, Searching, Analyzing Functions, Using Graphing Options, Jump Table, Adding Missing Code Cross-References in IDA Pro, Recognizing a Vtable, Detailed Analysis, Detailed Analysis, Using the Memory Map to Locate DLLs, Detailed Analysis

and virtual functions, Recognizing a Vtable

checking for gethostbyname, Detailed Analysis

for global variables, Using the Memory Map to Locate DLLs

graphs of, Analyzing Functions, Using Graphing Options, Detailed Analysis, Detailed Analysis

for function, Detailed Analysis

for installer export, Detailed Analysis

in IDA Pro, Useful Windows for Analysis, Searching, Adding Missing Code Cross-References in IDA Pro

adding missing code, Adding Missing Code Cross-References in IDA Pro

navigating, Useful Windows for Analysis

CryptAcquireContext function, Important Windows Functions

cryptographic algorithms, Identifying and Decoding Base64, Common Cryptographic Algorithms, Recognizing Strings and Imports, Using Krypto ANALyzer

recognizing strings and imports, Common Cryptographic Algorithms

search for cryptographic constants, Recognizing Strings and Imports

search for high-entropy content, Using Krypto ANALyzer

cryptography, drawbacks, Common Cryptographic Algorithms

CWSandbox, Basic Dynamic Analysis

The C Programming Language (Kernighan and Ritchie), Recognizing C Code Constructs in Assembly