Table of Contents for

Practical Malware Analysis

I

I/O communication port, query of, Using the Red Pill Anti-VM Technique

IAT (import address table), hooking method and, Covering Its Tracks—User-Mode Rootkits

ICE (In-Circuit Emulator) breakpoint, Inserting INT 3

IDA Pro (Interactive Disassembler Professional), IDA Pro, IDA Pro, Loading an Executable, Loading an Executable, Useful Windows for Analysis, Useful Windows for Analysis, Useful Windows for Analysis, Useful Windows for Analysis, Using Links and Cross-References, Using Links and Cross-References, Using Links and Cross-References, Jump to Location, Searching, Data Cross-References, Analyzing Functions, Enhancing Disassembly, Using Named Constants, Extending IDA with Plug-ins, Using IDC Scripts, Using Commercial Plug-ins, Lab 5-1, Recognizing if Statements, Finding for Loops, Configuring Windows Symbols, NULL-Preserving Single-Byte XOR Encoding, Recognizing Strings and Imports, Using Krypto ANALyzer, Analyze the Parsing Routines, Flow-Oriented Disassembly, Jump Instructions with the Same Target, Using TLS Callbacks, Querying the I/O Communication Port, Identifying Packed Programs, Using Automated Tools to Find the OEP, Using Automated Tools to Find the OEP, Tools for Malware Analysis, Tools for Malware Analysis, Short Answers, Detailed Analysis, Using the Memory Map to Locate DLLs, Viewing Lab10-01.sys in IDA Pro, Analyzing Lab10-01.sys in WinDbg, Detailed Analysis, Short Answers, Finding Anti-VM Techniques Using Strings

adding IP_ADAPTER_INFO structure, Finding Anti-VM Techniques Using Strings

analyzing functions, Data Cross-References

analyzing functions graphically, Recognizing if Statements

applying structure in, Using the Memory Map to Locate DLLs

comparison plug-in for, Tools for Malware Analysis

consecutive jump instructions in, Jump Instructions with the Same Target

cross-references, Searching

enhancing disassembly, Enhancing Disassembly

FindCrypt2, Using Krypto ANALyzer

for TLS callback function analysis, Using TLS Callbacks

graphing options, Analyzing Functions, Finding for Loops, Analyze the Parsing Routines, Using Automated Tools to Find the OEP

for loop, Finding for Loops

of parsing routines, Analyze the Parsing Routines

view for tail jump, Using Automated Tools to Find the OEP

highlighting anti-VM in, Querying the I/O Communication Port

identifying XOR loops in, NULL-Preserving Single-Byte XOR Encoding

interface, Loading an Executable, Loading an Executable, Useful Windows for Analysis, Useful Windows for Analysis

disassembly window modes, Loading an Executable

returning to default view, Useful Windows for Analysis

windows for analysis, Useful Windows for Analysis

labs, Lab 5-1, Short Answers

solutions, Short Answers

listing imported with cryptographic functions, Recognizing Strings and Imports

loading executable, IDA Pro

looking at user-space code in, Configuring Windows Symbols

manually switching bytes between data and instructions, Flow-Oriented Disassembly

navigating, Useful Windows for Analysis, Useful Windows for Analysis, Using Links and Cross-References, Using Links and Cross-References, Using Links and Cross-References

colors in navigation band, Using Links and Cross-References

exploring history, Using Links and Cross-References

jumping to location, Using Links and Cross-References

links and cross-references, Useful Windows for Analysis

packed program and, Identifying Packed Programs

plug-ins for extending, Using Named Constants, Extending IDA with Plug-ins, Using IDC Scripts, Using Commercial Plug-ins

commercial plug-ins, Using Commercial Plug-ins

IDAPython, Using IDC Scripts

IDC scripts, Extending IDA with Plug-ins

search for x86 instructions vulnerable to VM detection, Short Answers

searching, Jump to Location

searching packed executable for tail jump, Using Automated Tools to Find the OEP

to open driver, Viewing Lab10-01.sys in IDA Pro

toggling between graph and traditional view, Detailed Analysis

vs. WinDbg, Analyzing Lab10-01.sys in WinDbg

WinMain function in, Detailed Analysis

IDA Pro database (idb), IDA Pro

IDA Pro Entropy Plugin, Using Krypto ANALyzer, Searching for High-Entropy Content, Detailed Analysis, Detailed Analysis

graph from, Searching for High-Entropy Content

IDA Pro Free, IDA Pro

idaapi module in IDAPython, Using IDC Scripts

IDAPython, Using IDC Scripts

.idata section, in PE file, The PE File Headers and Sections

idautils module in IDAPython, Using IDC Scripts

idb (IDA Pro database), IDA Pro

idc module in IDAPython, Using IDC Scripts

IDC scripts, Extending IDA with Plug-ins

IDEA (International Data Encryption Algorithm), Using Krypto ANALyzer

identifying malware, hashing for, Antivirus Scanning: A Useful First Step

IDSs (intrusion detection systems), Network Countermeasures, Getting IP Address and Domain Information, Intrusion Detection with Snort

signature-based, Getting IP Address and Domain Information

with Snort, Intrusion Detection with Snort

IDT (Interrupt Descriptor Table), Rootkit Analysis in Practice, Vulnerable Instructions

IDT register (IDTR), Vulnerable Instructions

if statements, Disassembling Arithmetic Operations, Switch Options

for active Internet connection, Switch Options

recognizing, Disassembling Arithmetic Operations

IIDs (interface identifiers), The Component Object Model, Detailed Analysis

and COM functionality, Detailed Analysis

image base, Rebasing

IMAGE_DATA_DIRECTORY structure, PE Header Vulnerabilities

IMAGE_DOS_HEADER structure, The PE File Headers and Sections, Detailed Analysis

IMAGE_EXPORT_DIRECTORY array, export data in, Parsing PE Export Data

IMAGE_FILE_DLL, to modify PE header, Running Malware

IMAGE_FILE_HEADER, in PE file, The PE File Headers and Sections

IMAGE_NT_HEADERS structure, The PE File Headers and Sections, Detailed Analysis

IMAGE_OPTIONAL_HEADER structure, Inserting INT 3

IMAGE_OPTIONAL_HEADER, in PE file, Examining PE Files with PEview

IMAGE_SECTION_HEADER structure, Examining PE Files with PEview, Detailed Analysis

IMAGE_SUBSYSTEM_WINDOWS_CUI value, for console programs, Examining PE Files with PEview

IMAGE_SUBSYSTEM_WINDOWS_GUI value, for GUI programs, Examining PE Files with PEview

$iment command, in WinDbg, Searching for Symbols

imm.getRegs function, Using Instrumentation for Generic Decryption

imm.remoteVirtualAlloc command, Using Instrumentation for Generic Decryption

imm.setBreakpoint function, Using Instrumentation for Generic Decryption

imm.writeLong function, Using Instrumentation for Generic Decryption

imm.writeMemory command, Using Instrumentation for Generic Decryption

ImmDbg (Immunity Debugger), OllyDbg, Bookmarks, Using Instrumentation for Generic Decryption, Tools for Malware Analysis, Detailed Analysis

Python scripts for, Bookmarks

immediate operands, Main Memory

Immunity Debugger (ImmDbg), OllyDbg, Bookmarks, Using Instrumentation for Generic Decryption, Tools for Malware Analysis, Detailed Analysis

Python scripts for, Bookmarks

Immunity security company, OllyDbg

import address table (IAT), hooking method and, Covering Its Tracks—User-Mode Rootkits

Import Reconstructor (ImpRec), Manual Unpacking, Tools for Malware Analysis

import table, Detours, Manual Unpacking, Finding the OEP Manually, Detailed Analysis

absence of, Detailed Analysis

modification, Detours

rebuilding with Import Reconstructor, Manual Unpacking

repairing manually, Finding the OEP Manually

imported functions, Portable Executable File Format, Imported Functions, PotentialKeylogger.exe: An Unpacked Executable, Loading the Executable, Detailed Analysis

examining list, Detailed Analysis

packer resolving of, Loading the Executable

Imports window, in IDA Pro, Useful Windows for Analysis

ImpRec (Import Reconstructor), Manual Unpacking, Tools for Malware Analysis

in instruction (x86), Querying the I/O Communication Port

In-Circuit Emulator (ICE) breakpoint, Inserting INT 3

indexing service, malware starting, Detailed Analysis

indirection tactics, OPSEC = Operations Security

INetSim, Packet Sniffing with Wireshark, Basic Dynamic Tools in Practice, Basic Dynamic Tools in Practice, Tools for Malware Analysis, Detailed Analysis

logs for requests, Basic Dynamic Tools in Practice

inet_addr function, Important Windows Functions, Analyzing the DLL

information-stealing malware, Types of Malware

infrastructure, attackers’ use of existing, Attackers Use Existing Infrastructure

inheritance, in object-oriented programming, Inheritance and Function Overriding

.ini files, The Windows Registry

InInitializationOrderLinks list of structures, Finding kernel32.dll in Memory

initialization function, Viewing Structure Information

injected code, 64-bit version, 64-Bit Malware

inline hooking, Covering Its Tracks—User-Mode Rootkits, Detailed Analysis

function installing, Detailed Analysis

input function, and decoding, Identifying Custom Encoding

input/output system (I/O), in x86 architecture, Reverse-Engineering

inserting interrupts, Using Exceptions

installer export, graph of cross-references, Detailed Analysis

installing, The Structure of a Virtual Machine, Detailed Analysis

inline hook, Detailed Analysis

VMware Tools, The Structure of a Virtual Machine

InstallService, Running Malware

instance of class, Object-Oriented Programming

instruction pointer, Reverse-Engineering, Registers, Common Exceptions

debugger to change, Common Exceptions

instruction pointer–relative data addressing, in x64 architecture, Differences in x64 Architecture

instruction set, Levels of Abstraction

instructions, Main Memory, Impossible Disassembly, Querying the I/O Communication Port

bytes as part of multiple, Impossible Disassembly

in x86 architecture, Main Memory, Querying the I/O Communication Port

anti-VM, Querying the I/O Communication Port

INT 0x2E instruction, Exceptions: When Things Go Wrong

INT 2D anti-debugging technique, Inserting INT 3

INT 3 instruction, Exceptions, Using Exceptions

exception and, Exceptions

inserting, Using Exceptions

INT scanning, INT Scanning

Interactive Disassembly Professional, IDA Pro (see IDA Pro (Interactive Disassembly Professional))

interface identifiers (IIDs), The Component Object Model, Detailed Analysis

and COM functionality, Detailed Analysis

International Data Encryption Algorithm (IDEA), Using Krypto ANALyzer

Internet connection, Malware Analysis in Virtual Machines, Using Your Malware Analysis Machine, Detailed Analysis, Switch Options

if construct for active, Switch Options

malware and, Malware Analysis in Virtual Machines, Using Your Malware Analysis Machine

malware check for active, Detailed Analysis

Internet Explorer, third-party plug-ins for, CLSIDs, IIDs, and the Use of COM Objects

Internet functions, graph for functions connected with, Detailed Analysis

Internet Relay Chat (IRC), Hiding in Plain Sight

Internet services, simulating, Packet Sniffing with Wireshark

InternetCloseHandle function, Detailed Analysis, Detailed Analysis

InternetConnect function, Understanding Surrounding Code

InternetGetConnectedState function, Detailed Analysis, Detailed Analysis

InternetOpen function, The Server and Client Sides of Networking, Understanding Surrounding Code, Important Windows Functions, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Short Answers, Detailed Analysis

InternetOpenUrl function, The Server and Client Sides of Networking, Understanding Surrounding Code, Important Windows Functions, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis

InternetReadFile function, The Server and Client Sides of Networking, Understanding Surrounding Code, Important Windows Functions, Detailed Analysis, Detailed Analysis, Detailed Analysis

InternetWriteFile function, Understanding Surrounding Code, Important Windows Functions

interpreted languages, Levels of Abstraction

interprocess coordination, with mutexes, Creating a Thread

Interrupt Descriptor Table (IDT), Rootkit Analysis in Practice, Vulnerable Instructions

interrupts, Rootkit Analysis in Practice, Using Exceptions

anti-debugging with, Using Exceptions

rootkits and, Rootkit Analysis in Practice

intrusion detection systems (IDSs), Network Countermeasures, Getting IP Address and Domain Information, Intrusion Detection with Snort

signature-based, Getting IP Address and Domain Information

with Snort, Intrusion Detection with Snort

intrusion prevention systems (IPSs), Network Countermeasures

IoConnectInterrupt function, Rootkit Analysis in Practice

IoCreateDevice function, Analyzing the Executable in IDA Pro

IoCreateSymbolicLink function, Analyzing the Executable in IDA Pro

IoGetCurrentProcess function, Recovering the Hidden File, Analyzing the Functions of the Major Function Table

import for, Recovering the Hidden File

IopInvalidDeviceRequest function, Analyzing the Functions of the Major Function Table

IP addresses, Indications of Malicious Activity, OPSEC = Operations Security, Getting IP Address and Domain Information

and malicious activity, Indications of Malicious Activity

blacklists of, Getting IP Address and Domain Information

getting, OPSEC = Operations Security

IPRIP service, malware installed as, Detailed Analysis

IP_ADAPTER_INFO structure, adding to IDA Pro, Finding Anti-VM Techniques Using Strings

IRC (Internet Relay Chat), Hiding in Plain Sight

IRP_MJ_DEVICE_CONTROL function, Looking at the Kernel-Mode Code, Looking at the Kernel-Mode Code, Looking at the Kernel-Mode Code

code listing, Looking at the Kernel-Mode Code

locating function for, Looking at the Kernel-Mode Code

IRP_MJ_READ function, Looking at the Kernel-Mode Code

Irvine, Cynthia, Bypassing VMware Artifact Searching

isdataat Snort rule keyword, Taking a Deeper Look

IsDebuggerPresent function, Windows Debugger Detection, Important Windows Functions

IsNTAdmin function, Important Windows Functions

IsWow64Process function, Windows 32-Bit on Windows 64-Bit, Important Windows Functions, Detailed Analysis

effort to dynamically resolve, Detailed Analysis

Itanium, 64-Bit Malware

IWebBrowser2 interface, Navigate function, The Component Object Model

The IDA Pro Book (Eagle), IDA Pro