Table of Contents for

Practical Malware Analysis

F

fake services, Packet Sniffing with Wireshark

FakeDNS, Tools for Malware Analysis

faking networks, Comparing Registry Snapshots with Regshot, Using ApateDNS

Netcat (nc) for monitoring, Using ApateDNS

false positives, in Snort, Taking a Deeper Look

Fast Library Identification and Recognition Technology (FLIRT), IDA Pro, Decoding Stack-Formed Strings

signature detection, Decoding Stack-Formed Strings

fastcall calling convention, Push vs. Move

fibers, in Microsoft systems, Creating a Thread

“File contains too much data” error, in OllyDbg, PE Header Vulnerabilities

file mappings, File System Functions

file signatures, Antivirus Scanning: A Useful First Step

File system filters, in procmon, Filtering in Procmon

file system functions, in Windows API, File System Functions

FileInformation structure, Examining the Hook Function

FileInsight, Tools for Malware Analysis

FileMon tool, Running Malware

files, Taking Snapshots, Configuring Windows Symbols, Brute-Forcing XOR Encoding, Analyzing the EXE, Decoding Stack-Formed Strings, Examining the Hook Function, Hiding Files, Short Answers, Short Answers, Detailed Analysis

brute-forcing many, Brute-Forcing XOR Encoding

checking names, Decoding Stack-Formed Strings

hidden, Examining the Hook Function, Hiding Files

recovering, Hiding Files

malware creation of, Short Answers

malware modification of, Analyzing the EXE

malware opening of, Short Answers

malware uploading of, Detailed Analysis

transferring from virtual machine, Taking Snapshots

writing from kernel space, Configuring Windows Symbols

FILE_BOTH_DIR_INFORMATION structure, Examining the Hook Function

Filter dialog in Process Monitor, Detailed Analysis

filters, Monitoring with Process Monitor, Monitoring with Netcat

in procmon, Monitoring with Process Monitor

in Wireshark, Monitoring with Netcat

Find OEP plug-in (Section Hop), Rebuilding the Import Table with Import Reconstructor

FindCrypt2, Using Krypto ANALyzer, Detailed Analysis

output, Detailed Analysis

FindFirstFile function, PotentialKeylogger.exe: An Unpacked Executable, Important Windows Functions, Short Answers, Detailed Analysis, Analyzing the EXE, Detailed Analysis

finding, Finding Strings, Understanding Surrounding Code, Rebuilding the Import Table with Import Reconstructor, Rebuilding the Import Table with Import Reconstructor, Using Automated Tools to Find the OEP

networking code, Understanding Surrounding Code

original entry point (OEP), Rebuilding the Import Table with Import Reconstructor, Rebuilding the Import Table with Import Reconstructor, Using Automated Tools to Find the OEP

manually, Using Automated Tools to Find the OEP

with automated tools, Rebuilding the Import Table with Import Reconstructor

strings, Finding Strings

findKernel32Base function, A Full Hello World Example, Detailed Analysis, Detailed Analysis

FindNextFile function, PotentialKeylogger.exe: An Unpacked Executable, Short Answers, Detailed Analysis, Detailed Analysis

FindResource function, Launchers, Important Windows Functions, Detailed Analysis, Short Answers, Detailed Analysis

findSymbolByHash function, Using Hashed Exported Names, A Full Hello World Example, Detailed Analysis, Detailed Analysis

FindWindow function, Checking NTGlobalFlag, Important Windows Functions, Detailed Analysis

to search for debugger, Checking NTGlobalFlag

firewall, Setting Up Host-Only Networking, Kernel Issues for Windows Vista, Windows 7, and x64 Versions

and kernel patching, Kernel Issues for Windows Vista, Windows 7, and x64 Versions

for virtual machine, Setting Up Host-Only Networking

firmware, Levels of Abstraction

flags, General Registers

fldz instruction, Using fnstenv

FlexHEX, Tools for Malware Analysis

Flink pointers, Finding kernel32.dll in Memory

FLIRT (Fast Library Identification and Recognition Technology), IDA Pro, Decoding Stack-Formed Strings

signature detection, Decoding Stack-Formed Strings

floating-point instruction, Analyzing Linked List Traversal

flow chart, of current function, Analyzing Functions

flow control, obscuring, Impossible Disassembly, Impossible Disassembly, Adding Missing Code Cross-References in IDA Pro, Adding Missing Code Cross-References in IDA Pro, Misusing Structured Exception Handlers

adding missing code cross-references in IDA Pro, Adding Missing Code Cross-References in IDA Pro

function pointer problem, Impossible Disassembly

misusing structured exception handlers, Misusing Structured Exception Handlers

return pointer abuse, Adding Missing Code Cross-References in IDA Pro

flow Snort rule keyword, Taking a Deeper Look

flow-oriented disassembly, Understanding Anti-Disassembly, Linear Disassembly

fnstenv instruction, structure for, Using call/pop

for loops, Finding for Loops

ForceFlags field, in heap header, Checking the ProcessHeap Flag

format string, identifying, Detailed Analysis

formatting operands, in IDA Pro, Enhancing Disassembly

FPU (x87 floating-point unit), Using call/pop

FpuSaveState structure, Using call/pop

frame functions, Differences in the x64 Calling Convention and Stack Usage

FS segment register, and SEH chain, Misusing Structured Exception Handlers, Checking the BeingDebugged Flag

fsgina.dll, GINA Interception

fstenv instruction, structure for, Using call/pop

FtpPutFile function, Important Windows Functions, Short Answers

FtpSetCurrentDirectory function, Short Answers

function pointers, Impossible Disassembly, Use of Vtables

problem, Impossible Disassembly

functions, Portable Executable File Format, Static, Runtime, and Dynamic Linking, Exploring Dynamically Linked Functions with Dependency Walker, Imported Functions, Imported Functions, PotentialKeylogger.exe: An Unpacked Executable, PotentialKeylogger.exe: An Unpacked Executable, Running Malware, Data Cross-References, Analyzing Functions, Recognizing if Statements, cdecl, Software Execution Breakpoints, Rootkit Analysis in Practice, Thwarting Stack-Frame Analysis, Finding the OEP Manually, Using call/pop, The this Pointer, Inheritance and Function Overriding, Virtual vs. Nonvirtual Functions, Detailed Analysis, Analyzing the EXE, Analyzing the EXE, Detailed Analysis, Detailed Analysis, Lab 18-5 Solutions

analysis to determine stack frame construction, Thwarting Stack-Frame Analysis

analyzing in IDA Pro, Data Cross-References, Recognizing if Statements

graphically, Recognizing if Statements

call conventions, cdecl

decision to skip analysis, Analyzing the EXE

disassembly and memory dump, Software Execution Breakpoints

executable import by ordinal, Static, Runtime, and Dynamic Linking, Running Malware

executable use of, Portable Executable File Format

exported, Imported Functions

finding connection between, Detailed Analysis

finding that installs hook, Rootkit Analysis in Practice

graphing cross-references, Detailed Analysis

graphs of calls, Analyzing Functions

hard-coded locations for calls, Using call/pop

identifying at stored memory location, Lab 18-5 Solutions

imported, Imported Functions, PotentialKeylogger.exe: An Unpacked Executable

naming conventions, Exploring Dynamically Linked Functions with Dependency Walker

overloading in object-oriented programming, The this Pointer

program termination by, Detailed Analysis

recursive, Analyzing the EXE

search for information on, PotentialKeylogger.exe: An Unpacked Executable

stepping-over vs. stepping-into, Finding the OEP Manually

virtual vs. nonvirtual, Inheritance and Function Overriding, Virtual vs. Nonvirtual Functions

vtables, Virtual vs. Nonvirtual Functions

Functions window, in IDA Pro, Useful Windows for Analysis