Table of Contents for

Practical Malware Analysis

N

named constants, Using Named Constants

named pipes, watching for input on, Detailed Analysis

names, Exploring Dynamically Linked Functions with Dependency Walker, Labs, Enhancing Disassembly, Creating a Thread, DLL Injection, Parsing PE Export Data, Overloading and Mangling, Detailed Analysis, Detailed Analysis

conventions for functions, Exploring Dynamically Linked Functions with Dependency Walker

for lab files, Labs

for malicious DLL, DLL Injection

for mutexes, Creating a Thread

hashed exported, for symbol resolution, Parsing PE Export Data

mangling in C++, Overloading and Mangling

of locations, changing in IDA Pro, Enhancing Disassembly

of malware, string comparison, Detailed Analysis

of modules, getting, Detailed Analysis

Names window, in IDA Pro, Useful Windows for Analysis

namespaces, files accessible via, Files Accessible via Namespaces

NAT (Network Address Translation), Using Your Malware Analysis Machine, Attackers Use Existing Infrastructure

for VMware, Using Your Malware Analysis Machine

Native API, in Windows, Kernel vs. User Mode

native applications, The Native API

Navigate function, The Component Object Model, Understanding Surrounding Code

nc, Using ApateDNS (see Netcat (nc))

Nebbett, Gary, Windows NT/2000 Native API Reference, The Native API

nested if statements, Disassembling Arithmetic Operations, Recognizing if Statements

net start cisvc command, Detailed Analysis

net start command, Running Malware, Interprocess Coordination with Mutexes, Summary

Netcat (nc), Using ApateDNS, Downloaders and Launchers, Tools for Malware Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis

examining results, Detailed Analysis

output when listening on port 80, Detailed Analysis

reverse shells, Downloaders and Launchers

NetScheduleJobAdd function, Important Windows Functions, Using the Memory Map to Locate DLLs

NetShareEnum function, Important Windows Functions

network adapter, bridged, Using Your Malware Analysis Machine

Network Address Translation (NAT), Using Your Malware Analysis Machine, Attackers Use Existing Infrastructure

for VMware, Using Your Malware Analysis Machine

network countermeasures, Malware-Focused Network Signatures

Network filter, in procmon, Filtering in Procmon

network interface cards (NICs), virtual, VMware Artifacts

network signatures, The Goals of Malware Analysis, The Goals of Malware Analysis, Brute-Forcing XOR Encoding, Malware-Focused Network Signatures, Intrusion Detection with Snort, Identifying and Leveraging the Encoding Steps, Targeting Multiple Elements, Labs, Detailed Analysis, Decrypting AES, Network Signatures, Network Signatures, Detailed Analysis

analysis, Network Signatures

attacker’s perspective and, Targeting Multiple Elements

creating, Detailed Analysis

creating for Snort, Identifying and Leveraging the Encoding Steps

creating XOR brute-force, Brute-Forcing XOR Encoding

Emerging Threats list of, Intrusion Detection with Snort

for malware infection detection, The Goals of Malware Analysis

generating, Detailed Analysis

labs, Labs, Decrypting AES

solutions, Decrypting AES

User-Agent field for, Network Signatures

networking APIs, Berkeley Compatible Sockets

networks, Configuring VMware, Configuring VMware, Comparing Registry Snapshots with Regshot, The Server and Client Sides of Networking, Understanding Surrounding Code, Knowing the Sources of Network Content, Backdoor Analysis, Detailed Analysis, Examining the Hook in OllyDbg

analysis, Backdoor Analysis

capturing traffic, Examining the Hook in OllyDbg

faking, Comparing Registry Snapshots with Regshot

finding code, Understanding Surrounding Code

host-only, Configuring VMware

indications of functioning, Detailed Analysis

knowing sources of content, Knowing the Sources of Network Content

server and client sides, The Server and Client Sides of Networking

virtual, Configuring VMware

new operator, Use of Vtables, Creating and Destroying Objects, Detailed Analysis

nibble, Transforming Data to Base64

NICs (network interface cards), virtual, VMware Artifacts

No Pill technique, Using the Red Pill Anti-VM Technique

(see also sldt instruction (No Pill))

nonleaf functions, Differences in the x64 Calling Convention and Stack Usage

nonprivileged mode, Common Exceptions

nonvirtual functions, vs. virtual, Inheritance and Function Overriding

NOP instruction, in x86 architecture, Arithmetic

NOP sequence, Impossible Disassembly

NOP sled, shellcode and, Shellcode Encodings

NOP-ing out instructions with IDA Pro, Impossible Disassembly

NopBytes function, Impossible Disassembly

Norman SandBox, Basic Dynamic Analysis

Norton Ghost, Malware Analysis in Virtual Machines

noscript tags, malware commands from, Short Answers

NSPack, Entropy Calculation

NT namespace, Files Accessible via Namespaces

NtContinue function, The Native API, The Tail Jump

NtCreateFile function, Configuring Windows Symbols, Rootkit Analysis in Practice

ntdll.dll, Exploring Dynamically Linked Functions with Dependency Walker, Kernel vs. User Mode, Windows Debugger Detection, Finding kernel32.dll in Memory

NTGlobalFlag flag, Checking the ProcessHeap Flag, The ProcessHeap Flag

ntohl function, Memory Breakpoints

ntoskrnl.exe, Kernel vs. User Mode, Drivers and Kernel Code

malicious drivers and, Drivers and Kernel Code

NtQueryDirectoryFile function, Important Windows Functions, Finding the Rootkit, Hiding Files

as hook function, Finding the Rootkit

NtQueryInformationFile function, The Native API

NtQueryInformationKey function, The Native API

NtQueryInformationProcess function, Windows Debugger Detection, Important Windows Functions

NtQueryInformationThread function, The Native API

NtQuerySystemInformation function, The Native API

NtReadFile function, The Native API

NtSetInformationProcess function, Important Windows Functions

NtWriteFile function, The Native API, Configuring Windows Symbols

NULL bytes, avoiding in shellcode, A Full Hello World Example

NULL terminator, Finding Strings

NULL-preserving single-byte XOR encoding, Brute-Forcing XOR Encoding

Number of Opcode Bytes option, Jump Instructions with the Same Target

NXDOMAIN option, Using ApateDNS