Table of Contents for

Practical Malware Analysis

K

KANAL (Krypto ANALyzer), Using Krypto ANALyzer, Detailed Analysis, Detailed Analysis

KeInitializeApc function, APC Injection from User Space

KeInsertQueueApc function, APC Injection from User Space

kernel code, Drivers and Kernel Code, 64-Bit Malware, Applying a Structure in IDA Pro, Analyzing Lab10-01.sys in WinDbg

64-bit malware and, 64-Bit Malware

breakpoints, Applying a Structure in IDA Pro

malware creation of file, Analyzing Lab10-01.sys in WinDbg

kernel debugging, Kernel Debugging with WinDbg, Drivers and Kernel Code, Configuring Windows Symbols

looking at user-space code, Configuring Windows Symbols

setting up for VMware, Drivers and Kernel Code

WinDbg and, Kernel Debugging with WinDbg

kernel driver, creating service to load, Looking at the User-Space Code

kernel mode, Exceptions: When Things Go Wrong, Debugging, Bypassing VMware Artifact Searching

binary translation by VMware, Bypassing VMware Artifact Searching

for debuggers, vs. user mode, Debugging

in Windows, Exceptions: When Things Go Wrong

kernel patch protection, Kernel Issues for Windows Vista, Windows 7, and x64 Versions

kernel space, APC injection from, APC Injection from User Space

kernel-based keyloggers, Hash Dumping

kernel-mode APC, APC Injection

kernel-mode code, looking at, Looking at the Kernel-Mode Code

kernel32.dll, Static, Runtime, and Dynamic Linking, Exploring Dynamically Linked Functions with Dependency Walker, PotentialKeylogger.exe: An Unpacked Executable, Kernel vs. User Mode, Using fnstenv, Using fnstenv, Finding kernel32.dll in Memory, Short Answers, Detailed Analysis, Short Answers, Detailed Analysis, Analyzing the EXE

assembly code to find base address, Finding kernel32.dll in Memory

finding in memory, Using fnstenv

imported functions, Static, Runtime, and Dynamic Linking

imports from, Detailed Analysis, Short Answers

name change by malware, Detailed Analysis, Analyzing the EXE

shellcode and, Using fnstenv

viewing imports from, Short Answers

KERNEL_DRIVER service type, Services

Kernighan, Brian, The C Programming Language, Recognizing C Code Constructs in Assembly

KeServiceDescriptorTable function, Hiding Files

KeTickCount function, Short Answers

key, The Windows Registry, Common Cryptographic Algorithms

for cryptographic algorithms, Common Cryptographic Algorithms

in registry, The Windows Registry

key initialization code, identifying, Detailed Analysis

keyboard inputs, PotentialKeylogger.exe: An Unpacked Executable

keyloggers, Types of Malware, Hash Dumping, Local and Remote Hooks, Detailed Analysis, Summary, Detailed Analysis, Detailed Analysis

analysis, Detailed Analysis, Detailed Analysis

hooks for, Local and Remote Hooks

indications of, Detailed Analysis, Summary

KMixer.sys, Looking at the Kernel-Mode Code

KnownDLLs registry key, DLL Load-Order Hijacking

Krypto ANALyzer (KANAL), Using Krypto ANALyzer, Detailed Analysis, Detailed Analysis