Table of Contents for

Practical Malware Analysis

P

packed DLLs, Analyzing Without Fully Unpacking

packed executables, Examining PE Files with PEview, Identifying Packed Programs, Identifying Packed Programs, Automated Unpacking, Manual Unpacking

detecting, Examining PE Files with PEview

entropy calculation for, Identifying Packed Programs

identifying, Identifying Packed Programs

loading in OllyDbg, Automated Unpacking

repairing import table for, Manual Unpacking

packed files, Detailed Analysis, Detailed Analysis

indications of, Detailed Analysis

strings and, Detailed Analysis

packed malware, Finding Strings, Detecting Packers with PEiD

detecting with PEiD, Detecting Packers with PEiD

packers, Packers and Unpacking, Packer Anatomy, Loading the Executable, The Tail Jump, The Tail Jump, Repairing the Import Table Manually, Labs, Reviewing the Final Check

anatomy, Packer Anatomy

labs, Labs, Reviewing the Final Check

solutions, Reviewing the Final Check

resolving imports, Loading the Executable

tail jump, The Tail Jump

tips and tricks for common, Repairing the Import Table Manually

unpacking illustrated, The Tail Jump

packet listing, in Wireshark, Monitoring with Netcat

packet sniffing, with Wireshark, Monitoring with Netcat

packing algorithm, program to run in reverse, Automated Unpacking

padding characters, Base64 string and, Identifying and Decoding Base64

Parallels, The Structure of a Virtual Machine

parent classes in C++, Inheritance and Function Overriding, Recognizing a Vtable

child class functions from, Recognizing a Vtable

parent-child relationships, in classes, Inheritance and Function Overriding

parsing routines, Analyze the Parsing Routines, Analyze the Parsing Routines

analyzing, Analyze the Parsing Routines

IDA Pro graph of, Analyze the Parsing Routines

pass-the-hash attacks, GINA Interception

password check function, Detailed Analysis, Detailed Analysis

testing if disabled, Detailed Analysis

passwords, Monitoring with Netcat, Short Answers, Detailed Analysis

getting correct, Detailed Analysis

sniffing, Monitoring with Netcat

PatchByte function, Impossible Disassembly, Impossible Disassembly

PatchGuard, Kernel Issues for Windows Vista, Windows 7, and x64 Versions

patching, in OllyDbg, Patching

payload rule options, in Snort, Intrusion Detection with Snort

PCRE (Perl Compatible Regular Expression) notation, in Snort, Taking a Deeper Look, Identifying and Leveraging the Encoding Steps

pcre Snort rule keyword, Taking a Deeper Look

.pdata section, in PE file, The PE File Headers and Sections

.pdf documents, Analyzing Malicious Documents, Short Answers, Detailed Analysis

analyzing with Process Explorer, Analyzing Malicious Documents

objects created for, Detailed Analysis

PDF Dissector, Tools for Malware Analysis

PDF Tools, Tools for Malware Analysis

PE Explorer, Viewing the Resource Section with Resource Hacker, Entropy Calculation, Tools for Malware Analysis

unpacking plug-ins, Entropy Calculation

PE file format, Detecting Packers with PEiD (see Portable Executable (PE) file format)

PEB (Process Environment Block) structure, Windows Debugger Detection, Checking the BeingDebugged Flag, Detailed Analysis

documented, Checking the BeingDebugged Flag

PEBrowse Professional, Viewing the Resource Section with Resource Hacker

PECompact, Repairing the Import Table Manually

PeekNamedPipe function, Important Windows Functions, Detailed Analysis

PEiD, Detecting Packers with PEiD, Tools for Malware Analysis, Short Answers, Detailed Analysis, Detailed Analysis

detecting packers with, Detecting Packers with PEiD

KANAL output, Detailed Analysis

peripheral devices, connecting and disconnecting, Using Your Malware Analysis Machine

Perl Compatible Regular Expression (PCRE) notation, in Snort, Taking a Deeper Look, Identifying and Leveraging the Encoding Steps

persistence, The Windows Registry, Identifying Keyloggers in Strings Listings, Identifying Keyloggers in Strings Listings, SvcHost DLLs, Trojanized System Binaries, Detailed Analysis, Detailed Analysis

AppInit_DLLs for, Detailed Analysis

DLL load-order hijacking, Trojanized System Binaries

of registry, The Windows Registry

trojanized system binaries, SvcHost DLLs

Windows Registry for, Identifying Keyloggers in Strings Listings

Petite, PECompact

PEview, The PE File Headers and Sections, Tools for Malware Analysis, Short Answers, Short Answers, Detailed Analysis

examining PE files with, The PE File Headers and Sections

finding base address with, Short Answers

original and trojanized versions of cisvc.exe, Detailed Analysis

PhantOm plug-in, Checking the BeingDebugged Flag, The BeingDebugged Flag, The ProcessHeap Flag, Detailed Analysis

Phatbot, VMware detection, Using the Red Pill Anti-VM Technique

phishing, targeted, Indications of Malicious Activity

PIC (position-independent code), Shellcode Analysis

pipe symbol (|), in Snort, Intrusion Detection with Snort

plug-ins, Detecting Packers with PEiD, Using Named Constants, CLSIDs, IIDs, and the Use of COM Objects, Analyzing Shellcode, Checking the BeingDebugged Flag

for extending IDA Pro, Using Named Constants

in OllyDbg, Analyzing Shellcode, Checking the BeingDebugged Flag

PEiD, running of executables, Detecting Packers with PEiD

third-party, for Internet Explorer, CLSIDs, IIDs, and the Use of COM Objects

pointers, handles vs., File System Functions

Poison Ivy, Software Breakpoints, Software Breakpoints, Standard Back Trace, RATs

tracing, Standard Back Trace

use of VirtualAlloc function, Software Breakpoints

polling, User-Space Keyloggers

polymorphism, Virtual vs. Nonvirtual Functions

pop instruction, The Stack, Stack Layout, Finding the OEP Manually, Position-Independent Code

after call, Position-Independent Code

and tail jump, Finding the OEP Manually

pop-up ads, Recovering the Hidden File

popa instruction, Stack Layout, Trojanized System Binaries

popad instruction, Stack Layout

port 80, backdoor and, Downloaders and Launchers

Portable Executable (PE) file format, Detecting Packers with PEiD, PotentialKeylogger.exe: An Unpacked Executable, The PE File Headers and Sections, Examining PE Files with PEview, Viewing the Resource Section with Resource Hacker, IDA Pro, Rebasing, Launchers, Using TLS Callbacks, Inserting INT 3, PE Header Vulnerabilities, Loading the Executable, Repairing the Import Table Manually, Finding kernel32.dll in Memory, Short Answers, Short Answers, Detailed Analysis, Detailed Analysis, Detailed Analysis

.tls section, Using TLS Callbacks, Detailed Analysis

copying sections into memory, Detailed Analysis

examining file structure, Short Answers

header vulnerabilities, OllyDbg, Inserting INT 3

headers and sections, PotentialKeylogger.exe: An Unpacked Executable, Viewing the Resource Section with Resource Hacker

summary information, Viewing the Resource Section with Resource Hacker

IDA Pro support for, IDA Pro

indications in, Detailed Analysis

packed executables formatting of, Loading the Executable

parsing export data, Finding kernel32.dll in Memory

PEview for examining, The PE File Headers and Sections

rebasing and, Rebasing

Resource Hacker tool for viewing, Examining PE Files with PEview

resource section, Launchers, Short Answers

section headers, and OllyDbg crash, PE Header Vulnerabilities

ports, malware use of, Using ApateDNS

position-independent code (PIC), Shellcode Analysis

POST method, Hiding in Plain Sight

printf function, Push vs. Move, Differences in the x64 Calling Convention and Stack Usage, Differences in the x64 Calling Convention and Stack Usage, Detailed Analysis

call compiled for 32-bit processor, Differences in the x64 Calling Convention and Stack Usage

call compiled for 64-bit processor, Differences in the x64 Calling Convention and Stack Usage

IDA Pro problems recognizing, Detailed Analysis

privilege escalation, DLL Load-Order Hijacking, Privilege Escalation

SeDebugPrivilege, Privilege Escalation

privileged mode, Common Exceptions

ProcDump, WinUpack

Process activity filter, in procmon, Filtering in Procmon

process context, Exceptions: When Things Go Wrong

Process Environment Block (PEB) structure, Windows Debugger Detection, Checking the BeingDebugged Flag, Detailed Analysis

documented, Checking the BeingDebugged Flag

Process Explorer, Viewing Processes with Process Explorer, The Process Explorer Display, Using the Verify Option, Using the Verify Option, Basic Dynamic Tools in Practice, Tools for Malware Analysis, Detailed Analysis, Detailed Analysis

comparing strings, Using the Verify Option

Dependency Walker, Using the Verify Option

for finding DLL injection, Detailed Analysis

Verify option, The Process Explorer Display

viewing processes with, Viewing Processes with Process Explorer

Process Hacker, Tools for Malware Analysis

Process Monitor (procmon), Running Malware, Monitoring with Process Monitor, Monitoring with Process Monitor, Filtering in Procmon, Filtering in Procmon, Basic Dynamic Tools in Practice, Tools for Malware Analysis, Detailed Analysis, Detailed Analysis, X64 Code Path

boot logging options, Filtering in Procmon

display, Monitoring with Process Monitor

Filter dialog, Detailed Analysis

filtering in, Monitoring with Process Monitor

filters on toolbar, Filtering in Procmon

reviewing results, Basic Dynamic Tools in Practice

toggling event capture on and off, X64 Code Path

Process Name filter, in procmon, Filtering in Procmon

Process Properties window, Strings tab, Using the Verify Option

process replacement, The Process Explorer Display, DLL Injection

Process32First function, DLL Injection, APC Injection, Important Windows Functions

Process32Next function, DLL Injection, APC Injection, Important Windows Functions

processes, PotentialKeylogger.exe: An Unpacked Executable, The Process Explorer Display, Basic DLL Structure, Basic DLL Structure, Creating a Thread, Manual Unpacking, WinUpack, Analyzing the Functions of the Major Function Table, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Short Answers, Detailed Analysis

creating, Basic DLL Structure, Detailed Analysis

dumping from memory, Manual Unpacking, WinUpack

dynamically resolving enumeration imports, Short Answers

EBX register of suspended newly created, Detailed Analysis

enumerating, Detailed Analysis

for following running malware, Basic DLL Structure

function to open and manipulate, PotentialKeylogger.exe: An Unpacked Executable

hidden, Analyzing the Functions of the Major Function Table

interprocess coordination with mutexes, Creating a Thread

Properties window for, The Process Explorer Display

resuming suspended, Detailed Analysis

starting and replacing, Detailed Analysis

ProcessHeap flag, in PEB structure, Checking the ProcessHeap Flag

procmon, Running Malware (see Process Monitor (procmon))

programs, Examining PE Files with PEview (see executables)

prologue, The Stack, Differences in the x64 Calling Convention and Stack Usage

64-bit code, Differences in the x64 Calling Convention and Stack Usage

in functions, The Stack

Properties window, in Process Explorer, The Process Explorer Display

protocols, attackers mimicking existing, Hiding in Plain Sight

psapi.dll, Summary, Short Answers

push instruction, The Stack, Stack Layout, Push vs. Move, Trojanized System Binaries, Understanding Anti-Disassembly, Finding the OEP Manually, WinUpack, Lab 18-3 Solutions

to start functions in disassembly, Finding the OEP Manually

vs. mov, Push vs. Move

with return instruction for tail jump, WinUpack

Pwdump, GINA Interception

PyCommand Python script, Bookmarks

PyCrypto cryptography library, Manual Programming of Decoding Functions, Modified Base64 Decoding, Decrypting AES

potential pitfalls, Decrypting AES

Python, Using IDC Scripts, Bookmarks, Self-Decoding, Tools for Malware Analysis, Detailed Analysis

IDAPython, Using IDC Scripts

program to decode Base64-encoded string, Self-Decoding

PyCommand script, Bookmarks

script for converting data to string, Detailed Analysis