Table of Contents for

Practical Malware Analysis

M

MAC address, for virtual machine, VMware Artifacts

machine code, Levels of Abstraction

magic constant, Using Krypto ANALyzer

magic number, Querying the I/O Communication Port

main function, Detailed Analysis, Short Answers

determining start, Short Answers

starting analysis at, Detailed Analysis

main memory, in x86 architecture, Reverse-Engineering, Main Memory

major function table, Looking at the Kernel-Mode Code, Looking at the Kernel-Mode Code, Analyzing the Functions of the Major Function Table

analyzing functions of, Analyzing the Functions of the Major Function Table

finding, Looking at the Kernel-Mode Code

Malcode Analyst Pack, Tools for Malware Analysis

malicious documents, Process Explorer to analyze, Analyzing Malicious Documents

malloc function, Detailed Analysis

malware, Basic Dynamic Analysis, Antivirus Scanning: A Useful First Step, Finding Strings, Detecting Packers with PEiD, Sandbox Drawbacks, Analyzing Malicious Windows Programs, Network Countermeasures, Repairing the Import Table Manually, WinUpack, 64-Bit Malware, Detailed Analysis, Detailed Analysis, Detailed Analysis

(see also Windows malware)

64-bit, 64-Bit Malware

analyzing without unpacking, WinUpack

attempts to delete itself, Detailed Analysis

double-packed, Repairing the Import Table Manually

hashing for identifying, Antivirus Scanning: A Useful First Step

observing in natural habitat, Network Countermeasures

packed and obfuscated, Finding Strings

running, Sandbox Drawbacks

safe environment for running, Detecting Packers with PEiD

searching for evidence of encoding, Detailed Analysis

self-deletion scripting code, Detailed Analysis

types, Basic Dynamic Analysis

malware analysis, Malware Analysis Primer, The Goals of Malware Analysis, Types of Malware, The Structure of a Virtual Machine, Taking Snapshots, Combining Dynamic and Static Analysis Techniques, Tools for Malware Analysis

creating machine for, The Structure of a Virtual Machine

danger of overanalysis, Combining Dynamic and Static Analysis Techniques

general rules, Types of Malware

goals, Malware Analysis Primer

risks of using VMware for, Taking Snapshots

techniques, The Goals of Malware Analysis

(see also dynamic analysis; static analysis)

tools, Tools for Malware Analysis

malware behavior, Malware Behavior, Malware Behavior, Downloaders and Launchers, Netcat Reverse Shells, RATs, RATs, GINA Interception, GINA Interception, Hash Dumping, Identifying Keyloggers in Strings Listings, Identifying Keyloggers in Strings Listings, SvcHost DLLs, Trojanized System Binaries, DLL Load-Order Hijacking, Privilege Escalation, Using SeDebugPrivilege, Covering Its Tracks—User-Mode Rootkits, Covering Its Tracks—User-Mode Rootkits, Lab 11-1, Network Countermeasures, Analyzing the Functions of the Major Function Table

backdoor, Downloaders and Launchers

botnets, RATs

credential stealers, RATs, GINA Interception, GINA Interception, Hash Dumping

GINA interception, GINA Interception

hash dumping, GINA Interception

keystroke logging, Hash Dumping

downloaders and launchers, Malware Behavior

indications of, Network Countermeasures

labs, Lab 11-1, Analyzing the Functions of the Major Function Table

solutions, Analyzing the Functions of the Major Function Table

persistence, Identifying Keyloggers in Strings Listings, Identifying Keyloggers in Strings Listings, SvcHost DLLs, Trojanized System Binaries

DLL load-order hijacking, Trojanized System Binaries

trojanized system binaries, SvcHost DLLs

Windows Registry for, Identifying Keyloggers in Strings Listings

privilege escalation, DLL Load-Order Hijacking, Privilege Escalation

SeDebugPrivilege, Privilege Escalation

remote administration tool (RAT), Netcat Reverse Shells

user-mode rootkits, Using SeDebugPrivilege, Covering Its Tracks—User-Mode Rootkits, Covering Its Tracks—User-Mode Rootkits

IAT hooking, Covering Its Tracks—User-Mode Rootkits

inline hooking, Covering Its Tracks—User-Mode Rootkits

Mandiant, Comparing Registry Snapshots with Regshot, Entropy Calculation

ApateDNS, Comparing Registry Snapshots with Regshot

Red Curtain, Entropy Calculation

mangling, The this Pointer

manual unpacking, Automated Unpacking

MapViewOfFile function, File System Functions, Important Windows Functions, Detailed Analysis, Analyzing the EXE, Detailed Analysis

MapVirtualKey function, Important Windows Functions

mass malware, Types of Malware

MD5 (Message-Digest Algorithm 5), Antivirus Scanning: A Useful First Step

media files, shellcode stored within, NOP Sleds

memcmp function, Detailed Analysis

memcpy function, Detailed Analysis

memory, Global vs. Local Variables, Basic DLL Structure, Software Execution Breakpoints, Bypassing VMware Artifact Searching, Manual Unpacking, WinUpack, Using fnstenv, Creating and Destroying Objects, Tools for Malware Analysis, Finding the Driver in Memory with WinDbg, Detailed Analysis

addresses for global variables, Global vs. Local Variables

allocation for objects, Creating and Destroying Objects

checking for VMware artifacts, Bypassing VMware Artifact Searching

copying PE sections into, Detailed Analysis

dumping executable from, Manual Unpacking, WinUpack, Tools for Malware Analysis

finding device driver in, with WinDbg, Finding the Driver in Memory with WinDbg

finding kernel32.dll in, Using fnstenv

function dump, Software Execution Breakpoints

processes and, Basic DLL Structure

memory address operands, Main Memory

memory breakpoint, in OllyDbg, Breakpoints, Conditional Breakpoints

Memory dump window, in OllyDbg, The OllyDbg Interface

Memory Map window, in OllyDbg, The OllyDbg Interface

memory map, to locate DLLs, Using the Memory Map to Locate DLLs

memory window, WinDbg reading from, Setting Up Kernel Debugging

memory-access violations, Common Exceptions

Memoryze, Tools for Malware Analysis

message box, malware creation of, Summary

message flow, in Windows with and without hook injection, Process Replacement

Message-Digest Algorithm 5 (MD5), Antivirus Scanning: A Useful First Step

Metasploit, DLL Load-Order Hijacking, Using Hashed Exported Names

methods, C++ Analysis, The this Pointer

in C++ class, C++ Analysis

overloading, The this Pointer

microcode, in x86 architecture, Levels of Abstraction

Microsoft, Finding Strings, Static, Runtime, and Dynamic Linking, The Structure of a Virtual Machine, The Structure of a Virtual Machine, Setting Up Host-Only Networking, If Style, Services, Exceptions: When Things Go Wrong, Setting Breakpoints, Misusing Structured Exception Handlers, Important Windows Functions

(see also Windows)

Component Object Model (COM), Services

documentation, Important Windows Functions

firewall, Setting Up Host-Only Networking

Hyper-V, The Structure of a Virtual Machine

Software Data Execution Prevention (DEP), Misusing Structured Exception Handlers

symbols, Setting Breakpoints

Virtual PC, The Structure of a Virtual Machine

Visual Studio, Static, Runtime, and Dynamic Linking, If Style

calling conventions, If Style

wide character string, Finding Strings

Microsoft Developer Network (MSDN), Finding kernel32.dll in Memory

Microsoft signed binary, verifying, The Process Explorer Display

MIME (Multipurpose Internet Mail Extensions) standard, Base64 and, Other Simple Encoding Schemes

MmGetSystemRoutineAddress function, Rootkit Analysis in Practice, Important Windows Functions

mneumonics, in instructions, Main Memory

Module32First function, Important Windows Functions

Module32Next function, Important Windows Functions

modules, Setting Breakpoints, Detailed Analysis

getting name of, Detailed Analysis

listing in WinDbg, Setting Breakpoints

modulo operation, Arithmetic, Disassembling Arithmetic Operations, Disassembling Arithmetic Operations

mov instruction, Flags, Arithmetic, Stack Layout, Impossible Disassembly, Position-Independent Code, Detailed Analysis

position dependence, Position-Independent Code

movsb instruction, Rep Instructions

movsd instruction, Analyzing the EXE

movsx instruction, Branching

MS-DOS Stub Program, The PE File Headers and Sections

MSDN (Microsoft Developer Network), Finding kernel32.dll in Memory

MSDN online, PotentialKeylogger.exe: An Unpacked Executable

msg keyword, in Snort, Intrusion Detection with Snort

msgina.dll, and GINA, GINA Interception

msvcrt.dll, imports from, Detailed Analysis

mul instruction, Arithmetic

multibyte encoding algorithm, Identifying XOR Loops in IDA Pro

Multipurpose Internet Mail Extensions (MIME) standard, Base64 and, Other Simple Encoding Schemes

multithreaded version, of Windows reverse shell, Netcat Reverse Shells

mutants, Creating a Thread

mutexes, Basic Dynamic Tools in Practice, Creating a Thread, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis

creating, Detailed Analysis, Detailed Analysis

interprocess coordination with, Creating a Thread

malware creation of, Detailed Analysis

malware use of, Detailed Analysis

MZ header, in PE executable, Detailed Analysis