Table of Contents for

Practical Malware Analysis

L

lab environments, malware and, Network Countermeasures

labeling, in OllyDbg, Analyzing Shellcode

labs, Labs, Lab 3-1, Lab 5-1, Questions, Lab 7-1, Lab 9-1, Lab 10-1, Lab 11-1, Lab 12-1, Lab 13-1, Labs, Lab 15-1, Lab 16-1, Lab 17-1, Labs, Labs, Lab 20-1, Labs, Solutions to Labs, Detailed Analysis, Short Answers, Detailed Analysis, Detailed Analysis, Short Answers, Applying a Structure in IDA Pro, Analyzing the Functions of the Major Function Table, Summary, Detailed Analysis, Decrypting AES, Web Commands, Detailed Analysis, Short Answers, Reviewing the Final Check, Short Answers, Detailed Analysis, Detailed Analysis

64-bit malware, Labs, Detailed Analysis

solutions, Detailed Analysis

anti-debugging, Lab 16-1, Detailed Analysis

solutions, Detailed Analysis

anti-disassembly, Lab 15-1, Web Commands

solutions, Web Commands

anti-virtual machine (anti-VM) techniques, Lab 17-1, Short Answers

solutions, Short Answers

C code constructs in assembly, Questions, Detailed Analysis

solutions, Detailed Analysis

C++ analysis, Lab 20-1, Detailed Analysis

solutions, Detailed Analysis

covert launching techniques, Lab 12-1, Summary

solutions, Summary

data encoding, Lab 13-1, Detailed Analysis

solutions, Detailed Analysis

dynamic analysis, Lab 3-1, Detailed Analysis

solutions, Detailed Analysis

IDA Pro, Lab 5-1, Short Answers

solutions, Short Answers

malware behavior, Lab 11-1, Analyzing the Functions of the Major Function Table

solutions, Analyzing the Functions of the Major Function Table

network signatures, Labs, Decrypting AES

solutions, Decrypting AES

OllyDbg, Lab 9-1, Short Answers

solutions, Short Answers

packers, Labs, Reviewing the Final Check

solutions, Reviewing the Final Check

shellcode analysis, Labs, Short Answers

solutions, Short Answers

static analysis, Labs, Solutions to Labs

solutions, Solutions to Labs

WinDbg, Lab 10-1, Applying a Structure in IDA Pro

solutions, Applying a Structure in IDA Pro

Windows malware, Lab 7-1, Detailed Analysis

solutions, Detailed Analysis

last in, first out (LIFO) structure, The Stack

launchers, Types of Malware, Malware Behavior

(see also covert launching techniques)

LdrGetProcAddress function, Portable Executable File Format

LdrLoadDll function, Portable Executable File Format, Important Windows Functions

LDT (local descriptor table), Vulnerable Instructions

LDT register (LDTR), Vulnerable Instructions

lea instruction (load effective address), Flags

leaf functions, Differences in the x64 Calling Convention and Stack Usage

leave instruction, The Stack

left rotation (rol), Arithmetic

legacy graphs, in IDA Pro, Analyzing Functions

libdisasm disassembly library, Linear Disassembly

LIFO (last in, first out) structure, The Stack

linear disassembly, Understanding Anti-Disassembly, Linear Disassembly

vs. flow-oriented, Linear Disassembly

linked libraries, executable use of, Portable Executable File Format

linked list traversal, Analyzing Linked List Traversal

links, navigating in IDA Pro, Useful Windows for Analysis

Linux virtual machine, Basic Dynamic Tools in Practice

listen function, Berkeley Compatible Sockets, The Server and Client Sides of Networking

listen mode, in Netcat, Using ApateDNS

LIST_ENTRY structure, Finding kernel32.dll in Memory, Analyzing the Functions of the Major Function Table

little-endian data, Main Memory

lm command, in WinDbg, Setting Breakpoints, Rootkit Analysis in Practice, Analyzing Lab10-01.sys in WinDbg, Detailed Analysis

ln command, in WinDbg, Searching for Symbols

loaddll.exe, Memory Breakpoints, Analyzing Without Fully Unpacking

OllyDbg use of, Memory Breakpoints

loader, Downloaders and Launchers

(see also launchers)

loading, IDA Pro, Loading Drivers, Packer Anatomy

device drivers, Loading Drivers

executable, IDA Pro, Packer Anatomy

in IDA Pro, IDA Pro

LoadLibrary function, Finding Strings, Portable Executable File Format, Thread Targeting, Loading the Executable, Identifying Packed Programs, Using fnstenv, Parsing PE Export Data, Important Windows Functions, Detailed Analysis, Detailed Analysis, Short Answers, Using the Memory Map to Locate DLLs, Using the Memory Map to Locate DLLs, Detailed Analysis, Lab 18-5 Solutions

finding last call, Lab 18-5 Solutions

unpacking stub import of, Loading the Executable

LoadResource function, Launchers, Important Windows Functions, Detailed Analysis, Short Answers, Detailed Analysis

loc links, in IDA Pro, Using Links and Cross-References

local administrator, user running as, DLL Load-Order Hijacking

local descriptor table (LDT), Vulnerable Instructions

local hooks, Local and Remote Hooks

local machine, loading buffer with hostname, Detailed Analysis

Local Security Authority Subsystem Service (LSASS) process, GINA Interception

local user accounts, password hashes of, GINA Interception

local variables, vs. global, Recognizing C Code Constructs in Assembly

locally unique identifiers (LUIDs), Hash Dumping, Using SeDebugPrivilege

locations, name changes in IDA Pro, Enhancing Disassembly

LockResource function, Detailed Analysis, Detailed Analysis

logging, Analyzing Shellcode, User-Space Keyloggers, Analysis of msgina32.dll, Detailed Analysis

active window, User-Space Keyloggers

errors in malware, Detailed Analysis

in OllyDbg, Analyzing Shellcode

of credentials, Analysis of msgina32.dll

logical operators, Arithmetic

logon, credential stealers, RATs

long pointer (LP) type, in Windows API, Handles

LookupPrivilegeValueA function, Using SeDebugPrivilege, Detailed Analysis

loopback encoding algorithm, Other Simple Encoding Schemes

loops, Finding for Loops, Finding the OEP Manually

in C code, Finding for Loops

setting breakpoints after, Finding the OEP Manually

LordPE, Tools for Malware Analysis

low-level language level, Levels of Abstraction, Levels of Abstraction

low-level remote hooks, Local and Remote Hooks

LowLevelKeyboardProc export, PotentialKeylogger.exe: An Unpacked Executable

LowLevelMouseProc export, PotentialKeylogger.exe: An Unpacked Executable

LsaEnumerateLogonSessions function, Important Windows Functions

lsaext.dll, GINA Interception

LSASS (Local Security Authority Subsystem Service) process, GINA Interception

lsass.exe, GINA Interception

LUIDs (locally unique identifiers), Hash Dumping