Table of Contents for

Practical Malware Analysis

H

hal.dll, malicious drivers and, Drivers and Kernel Code

handles, File System Functions, Looking at the User-Space Code, Looking at the Kernel-Mode Code, Hash Dumping, DLL Injection, Detailed Analysis, Detailed Analysis, Detailed Analysis

for device objects, Looking at the User-Space Code, Looking at the Kernel-Mode Code

obtaining, Looking at the User-Space Code

for injecting malicious DLL, DLL Injection

for service, OpenService function for, Detailed Analysis

in Windows API, File System Functions

locating for PDF document, Detailed Analysis

obtaining to samsrv.dll and advapi32.dll, Hash Dumping

to Winlogon, opening, Detailed Analysis

handles type (H) type, in Windows API, Handles

Handles window, in Process Explorer, The Process Explorer Display

hard-coded headers, Network Signatures

hard-coded locations, for function calls, Using call/pop

hardware breakpoints, Breakpoints, Conditional Breakpoints, INT Scanning, Lab 18-3 Solutions

in OllyDbg, Breakpoints, Conditional Breakpoints

vs. software, Lab 18-3 Solutions

hardware level, in x86 architecture, Levels of Abstraction

hash dumping, GINA Interception, Hash Dumping

identifying method, Hash Dumping

hash function, Using Hashed Exported Names

hashed exported names, for symbol resolution, Parsing PE Export Data

hashing, Antivirus Scanning: A Useful First Step

headers, PotentialKeylogger.exe: An Unpacked Executable, Network Signatures

hard-coded, Network Signatures

in PE file format, PotentialKeylogger.exe: An Unpacked Executable

Heads function, Using IDC Scripts

heap, Main Memory

heap space, creating, Creating and Destroying Objects

heap spray, Detailed Analysis

heap structures, information for creating, Checking the ProcessHeap Flag

Hello World program, Using fnstenv, Using Hashed Exported Names

disassembly, Using fnstenv

help, in OllyDbg, Analyzing Shellcode

heuristics, Antivirus Scanning: A Useful First Step

Hex Editor Neo, Tools for Malware Analysis

hex editors, Tools for Malware Analysis

hex window, in Wireshark, Monitoring with Netcat

Hex Workshop, Tools for Malware Analysis

Hex-Rays Decompiler plug-in, Using Commercial Plug-ins, Thwarting Stack-Frame Analysis, Tools for Malware Analysis

HexEdit, Tools for Malware Analysis

hidden files, Examining the Hook Function, Hiding Files

recovering, Hiding Files

hidden process, Analyzing the Functions of the Major Function Table

Hide Debugger plug-in, Plug-ins, Checking the BeingDebugged Flag

for OllyDbg, Plug-ins

Hidedebug plug-in, Checking the BeingDebugged Flag

high-entropy content, search for, Using Krypto ANALyzer

high-level language, Levels of Abstraction, Levels of Abstraction

high-level remote hooks, Local and Remote Hooks

HKEY, The Windows Registry

HKEY_CLASSES_ROOT, Common Registry Functions, Short Answers

\http\shell\open\command, Short Answers

HKEY_CURRENT_CONFIG, Common Registry Functions

HKEY_CURRENT_USER (HKCU), Common Registry Functions

HKEY_LOCAL_MACHINE (HKLM), Common Registry Functions

HKEY_LOCAL_MACHINE\Software registry key, Windows 32-Bit on Windows 64-Bit, Detailed Analysis, Detailed Analysis, Detailed Analysis, Short Answers

\Microsoft\Cryptography\RNG\Seed, Detailed Analysis, Short Answers

RegSetValue, Detailed Analysis

\Microsoft\Windows NT\CurrentVersion\SvcHost, Detailed Analysis

\Microsoft\Windows\CurrentVersion\Run, Detailed Analysis

HKEY_USERS, Common Registry Functions

HlpGetPrimaryCredential function, Hash Dumping

$HOME_NET variable, in Snort, Intrusion Detection with Snort

honeypots, Anti-Virtual Machine Techniques

hook function, NtQueryDirectoryFile function as, Finding the Rootkit

hook injection, Process Replacement, Thread Targeting

assembly code, Thread Targeting

hooking, Finding Driver Objects, Rootkits, Rootkit Analysis in Practice, User-Space Keyloggers, Covering Its Tracks—User-Mode Rootkits, Local and Remote Hooks, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis

examining in OllyDbg, Detailed Analysis

function, Detailed Analysis

inline, Covering Its Tracks—User-Mode Rootkits

keylogger and, User-Space Keyloggers

local and remote, Local and Remote Hooks

looking for code, Rootkit Analysis in Practice

low-level operation, Detailed Analysis

malware, installing code for, Detailed Analysis

System Service Descriptor Table (SSDT), Finding Driver Objects, Rootkits

checking for, Rootkits

host-based signatures, The Goals of Malware Analysis

host-only networking, Configuring VMware

hostname, Detailed Analysis, Detailed Analysis, Detailed Analysis

Base64 string for encoding, Detailed Analysis

function to obtain, Detailed Analysis

of local machine, loading buffer, Detailed Analysis

hotkeys, registering, PotentialKeylogger.exe: An Unpacked Executable

HTML (HyperText Markup Language) comments, Detailed Analysis, Detailed Analysis, Detailed Analysis

command character parsed from, Detailed Analysis

to send commands to malware, Detailed Analysis

htons function, Detailed Analysis

$HTTP_PORTS variable, in Snort, Intrusion Detection with Snort

HTTP (HyperText Transfer Protocol), Downloaders and Launchers, Hiding in Plain Sight, Networking Analysis

attackers’ use of, Hiding in Plain Sight

port 80 and, Downloaders and Launchers

reverse backdoor, Networking Analysis

HTTP server, Using Your Malware Analysis Machine, Using INetSim, Detailed Analysis

backdoor indicators, Detailed Analysis

malware access to, Using Your Malware Analysis Machine

simulating, Using INetSim

HTTPOpenRequest function, Understanding Surrounding Code

HTTPQueryInfo function, Understanding Surrounding Code

HTTPS server, simulating, Using INetSim

HTTPS, attackers’ use of, Hiding in Plain Sight

HTTPSendRequest function, Understanding Surrounding Code

Hungarian notation, Handles

Hyde, Randall, The Art of Assembly Language, Reverse-Engineering

HyperText Markup Language (HTML) comments, Detailed Analysis, Detailed Analysis, Detailed Analysis

command character parsed from, Detailed Analysis

to send commands to malware, Detailed Analysis

HyperText Transfer Protocol (HTTP), Downloaders and Launchers, Hiding in Plain Sight, Networking Analysis

attackers’ use of, Hiding in Plain Sight

port 80 and, Downloaders and Launchers

reverse backdoor, Networking Analysis