Table of Contents for

Practical Malware Analysis

E

EA (effective address), in IDAPython scripts, Using IDC Scripts

Eagle, Chris, The IDA Pro Book, IDA Pro

EAT (export address table), hooking method and, Covering Its Tracks—User-Mode Rootkits

EAX register, Arithmetic, Detailed Analysis

EBP register, The Stack

ECB (Electronic Code Book), Decrypting AES

Eckel, Bruce, Thinking in C++, Object-Oriented Programming

ECX register, this parameter and, The this Pointer

.edata section, in PE file, The PE File Headers and Sections

EDI register, Branching

EDX register, Arithmetic

effective address (EA), in IDAPython scripts, Using IDC Scripts

EFLAGS register, General Registers

EIP (instruction pointer), Flags

Electronic Code Book (ECB), Decrypting AES

ELF (Executable and Linking Format), IDA Pro support for, IDA Pro

EM64T architecture, 64-Bit Malware

email-stealing malware, Detailed Analysis

Emerging Threats list of signatures, Intrusion Detection with Snort

EnableExecuteProtectionSupport function, Important Windows Functions

encoding, Data Encoding (see data encoding)

encoding functions, Detailed Analysis, Detailed Analysis

encrypted files, Identifying Custom Encoding, Detailed Analysis

first bytes of, Identifying Custom Encoding

writing, Detailed Analysis

encrypted write, function graph of, Identifying Custom Encoding

encryption, Detailed Analysis, Short Answers, Detailed Analysis

decoding algorithm with OllyDbg, Detailed Analysis

indications of, Short Answers

relationship of functions, Detailed Analysis

endianness, in x86 architecture, Instructions

enter instruction, The Stack

entropy calculation, for packed executables, Identifying Packed Programs

entropy score, dependency with chunk size, Searching for High-Entropy Content

EnumProcesses function, Important Windows Functions, Detailed Analysis

EnumProcessModules function, Important Windows Functions

epilogue, The Stack, Differences in the x64 Calling Convention and Stack Usage

64-bit code, Differences in the x64 Calling Convention and Stack Usage

in functions, The Stack

EPROCESS structure, Analyzing the Functions of the Major Function Table, Analyzing the Functions of the Major Function Table

changing, Analyzing the Functions of the Major Function Table

examining in WinDbg, Analyzing the Functions of the Major Function Table

error message strings, Detailed Analysis, Detailed Analysis

finding in binary, Detailed Analysis

indicators of malware’s likely functions, Detailed Analysis

ESI register, Branching

ESP register, The Stack, Thwarting Stack-Frame Analysis

event capture, toggling on and off in procmon, X64 Code Path

event flow, in Windows with and without hook injection, Process Replacement

Ex suffix, for Windows functions, Exploring Dynamically Linked Functions with Dependency Walker

exception handlers, Tracing Poison Ivy, Misusing Structured Exception Handlers, Differences in the x64 Calling Convention and Stack Usage, Prologue and Epilogue 64-Bit Code, Detailed Analysis, Detailed Analysis

building, Detailed Analysis

in 64-bit systems, Differences in the x64 Calling Convention and Stack Usage, Prologue and Epilogue 64-Bit Code

in OllyDbg, Tracing Poison Ivy

misusing structured, Misusing Structured Exception Handlers

properly disassembled code, Detailed Analysis

ExceptionHandler function, Misusing Structured Exception Handlers

exceptions, CLSIDs, IIDs, and the Use of COM Objects, Hardware Execution Breakpoints, Exceptions, Misusing Structured Exception Handlers, Using TLS Callbacks

in debuggers, Hardware Execution Breakpoints, Exceptions

first- and second-chance, Exceptions

in Windows, CLSIDs, IIDs, and the Use of COM Objects

EXCEPTION_REGISTRATION data structure, Misusing Structured Exception Handlers

exclusive OR cipher, XOR (see XOR cipher)

.exe files, program infecting, Detailed Analysis

Executable and Linking Format (ELF), IDA Pro support for, IDA Pro

executables, Finding Strings, Detecting Packers with PEiD, Static, Runtime, and Dynamic Linking, Examining PE Files with PEview, Running Malware, IDA Pro, OllyDbg, Packer Anatomy, Shellcode Analysis, Tools for Malware Analysis, Detailed Analysis, Detailed Analysis

(see also packed executables)

dumping from memory, Tools for Malware Analysis

function import by ordinal, Static, Runtime, and Dynamic Linking, Running Malware

loading, IDA Pro, Packer Anatomy, Detailed Analysis

in IDA Pro, IDA Pro

into address space of another process, Detailed Analysis

opening in OllyDbg, OllyDbg

PEiD plug-ins running of, Detecting Packers with PEiD

searching for strings in, Finding Strings

shellcode as, Shellcode Analysis

termination, Detailed Analysis

exit, analysis of immediate, Detailed Analysis

expediency, vs. accuracy, Intrusion Detection with Snort

exploits, DLL Load-Order Hijacking

explorer.exe, Detailed Analysis, X64 Code Path

code search for, X64 Code Path

writing path into process, Detailed Analysis

export address table (EAT), hooking method and, Covering Its Tracks—User-Mode Rootkits

export data, in IMAGE_EXPORT_DIRECTORY array, Parsing PE Export Data

exported functions, Imported Functions, Detailed Analysis

absence of, Detailed Analysis

Exports window, in IDA Pro, Useful Windows for Analysis

$EXTERNAL_NET variable, in Snort, Intrusion Detection with Snort