Table of Contents for

Practical Malware Analysis

O

!object command, in WinDbg, Analyzing Lab10-01.sys in WinDbg

object-oriented programming, C++ Analysis, Object-Oriented Programming, The this Pointer

overloading and mangling, The this Pointer

this pointer, Object-Oriented Programming

objects, creating and destroying in C++, Creating and Destroying Objects

OEP, WinUpack (see original entry point (OEP))

OfficeMalScanner, Tools for Malware Analysis

offset links, in IDA Pro, Using Links and Cross-References

OleInitialize function, Services, Important Windows Functions, Detailed Analysis

OllyDbg, Debugging, Pausing Execution with Breakpoints, OllyDbg, OllyDbg, Opening an Executable, The OllyDbg Interface, Rebasing, Absolute vs. Relative Addresses, Viewing Threads and Stacks, Breakpoints, Memory Breakpoints, Loading DLLs, Tracing Poison Ivy, Patching, Patching, Analyzing Shellcode, Analyzing Shellcode, Bookmarks, Lab 9-1, Checking the BeingDebugged Flag, Using TLS Callbacks, Using Exceptions, Inserting INT 3, PE Header Vulnerabilities, PE Header Vulnerabilities, Identifying Packed Programs, Automated Unpacking, Finding the OEP Manually, WinUpack, Analyzing Without Fully Unpacking, Using call/pop, Using call/pop, Tools for Malware Analysis, Short Answers, Detailed Analysis, Detailed Analysis, Backdoor Analysis, Using the Memory Map to Locate DLLs, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Lab 18-3 Solutions, Lab 18-4 Solutions, Short Answers

analysis, Lab 18-4 Solutions

as just-in-time debugger, Using call/pop, Short Answers

assistance features, Analyzing Shellcode

breakpoints, Breakpoints

choosing to debug arguments, Detailed Analysis

debug window from, Pausing Execution with Breakpoints

default settings for exceptions, Using Exceptions

disassembly view, Detailed Analysis

examining hook in, Detailed Analysis

exception handling, Tracing Poison Ivy

executing code, Viewing Threads and Stacks

finding function addresses with, Using call/pop

forcing code disassembly, Lab 18-3 Solutions

interface, Opening an Executable

labs, Lab 9-1, Short Answers

solutions, Short Answers

loading DLLs, Memory Breakpoints, Analyzing Without Fully Unpacking

loading malware, OllyDbg, Detailed Analysis

loading packed executable in, Automated Unpacking

memory map to examine DLL load locations, Using the Memory Map to Locate DLLs

Memory Map window, The OllyDbg Interface

opening malware with, Backdoor Analysis

OutputDebugString format string vulnerability, PE Header Vulnerabilities

packed program and, Identifying Packed Programs

patching, Patching

pausing before TLS callback, Using TLS Callbacks

plug-ins, Analyzing Shellcode, Checking the BeingDebugged Flag

premature termination of program in, Detailed Analysis

rebasing, Rebasing

Run Trace option, Finding the OEP Manually

screen capture decoding with, Detailed Analysis

scriptable debugging, Bookmarks

shellcode analysis, Patching

strncmp function in, Detailed Analysis

tracing, Loading DLLs

viewing threads and stacks, Absolute vs. Relative Addresses

vulnerabilities in, Inserting INT 3

WinUpack and, WinUpack

OllyDump, Plug-ins, Automated Unpacking, Lab 18-1 Solutions, Lab 18-2 Solutions, Lab 18-2 Solutions, Lab 18-3 Solutions, Lab 18-5 Solutions

dumping unpacked program, Lab 18-5 Solutions

Find OEP by Section Hop (Trace Into), Lab 18-2 Solutions

Find OEP by Section Hop (Trace Over), Lab 18-1 Solutions, Lab 18-3 Solutions

forcing code disassembly, Lab 18-2 Solutions

opcodes, in x86 architecture, Levels of Abstraction, Instructions

open source sniffer, Monitoring with Netcat

OpenMutex function, Interprocess Coordination with Mutexes, Important Windows Functions, Analyzing the DLL

OpenProcess function, Important Windows Functions

OpenProcessToken function, Using SeDebugPrivilege, Detailed Analysis

OpenSCManager function, Services, Important Windows Functions, Detailed Analysis, Detailed Analysis, Short Answers, Detailed Analysis, Analyzing Lab10-01.sys in WinDbg

OpenService function, Short Answers, Detailed Analysis

OpenSSL, Common Cryptographic Algorithms

operands, Main Memory, Instructions, Enhancing Disassembly

formatting in IDA Pro, Enhancing Disassembly

in x86 architecture, Main Memory, Instructions

operating systems (OSs), backup images of, Malware Analysis in Virtual Machines

Operation filter, in procmon, Filtering in Procmon

operational replication, Combining Dynamic and Static Analysis Techniques

operations security (OPSEC), Indications of Malicious Activity

or instruction, Arithmetic

OR logical operator, in x86 architecture, Arithmetic

ordinal, executable import of functions by, Static, Runtime, and Dynamic Linking, Running Malware

original entry point (OEP), Packer Anatomy, The Tail Jump, Rebuilding the Import Table with Import Reconstructor, Rebuilding the Import Table with Import Reconstructor, Using Automated Tools to Find the OEP, WinUpack, Analyzing Without Fully Unpacking, Lab 18-5 Solutions

code around, WinUpack

finding, Rebuilding the Import Table with Import Reconstructor, Rebuilding the Import Table with Import Reconstructor, Using Automated Tools to Find the OEP

manually, Using Automated Tools to Find the OEP

with automated tools, Rebuilding the Import Table with Import Reconstructor

in DLLs, Analyzing Without Fully Unpacking

indications of, Lab 18-5 Solutions

transferring execution to, The Tail Jump

unpacking stub and, Packer Anatomy

orphaned process, Detailed Analysis

OSR Driver Loader, Tools for Malware Analysis

OSs (operating systems), backup images of, Malware Analysis in Virtual Machines

Outlook Express, Detailed Analysis

output functions, tracing from, Identifying Custom Encoding

OutputDebugString function, Using the Windows API, Important Windows Functions, Detailed Analysis

overanalysis, danger of, Combining Dynamic and Static Analysis Techniques

overloading, The this Pointer