Table of Contents for

Practical Malware Analysis

R

radio-frequency identification (RFID) tokens, GINA Interception

RaiseException function, CLSIDs, IIDs, and the Use of COM Objects, Misusing Structured Exception Handlers

Random function, Understanding Surrounding Code, Knowing the Sources of Network Content

random number generator seed, Detailed Analysis

RAT (remote administration tool), Netcat Reverse Shells

raw data, translating to Base64, Other Simple Encoding Schemes

RC4 algorithm, Using Krypto ANALyzer

RCPT command (SMTP), Detailed Analysis

.rdata section, in PE file, PotentialKeylogger.exe: An Unpacked Executable

rdtsc function, The GetTickCount Function

rdtsc instruction, for timing check, Timing Checks

read breakpoints, for finding tail jump, Finding the OEP Manually

ReadFile function, File System Functions, Looking at the Kernel-Mode Code, Detailed Analysis

origin of handle passed to, Detailed Analysis

ReadProcessMemory function, Important Windows Functions, Detailed Analysis

rebasing, IDA Pro, Rebasing

in OllyDbg, Rebasing

receiving data, and code analysis, Understanding Surrounding Code

recovery of hidden files, Hiding Files

recursive function, Analyzing the EXE

recv function, Berkeley Compatible Sockets, The Server and Client Sides of Networking, Understanding Surrounding Code, Important Windows Functions

Red Pill anti-VM technique, Vulnerable Instructions

(see also sidt instruction (Red Pill))

reference Snort rule keyword, Taking a Deeper Look

RegCreateKeyEx function, Windows 32-Bit on Windows 64-Bit

RegDeleteKeyEx function, Windows 32-Bit on Windows 64-Bit

Regedit (Registry Editor), Common Registry Functions

RegGetValue function, Analyzing Registry Code in Practice

Regional Internet Registries (RIRs), Getting IP Address and Domain Information

register operands, Main Memory

RegisterClassEx function, PotentialKeylogger.exe: An Unpacked Executable

RegisterHotKey function, PotentialKeylogger.exe: An Unpacked Executable, Important Windows Functions

registers, Reverse-Engineering, Registers, Arithmetic, Differences in x64 Architecture

in x64 architecture, Differences in x64 Architecture

in x86 architecture, Registers

shifting, Arithmetic

Registers window, in OllyDbg, The OllyDbg Interface

registries, for Internet addresses, Getting IP Address and Domain Information

\Registry\Machine strings, Short Answers

Registry (Windows), Analyzing Malicious Documents, The Windows Registry, Common Registry Functions, Analyzing Registry Code in Practice, Analyzing Registry Code in Practice, Registry Scripting with .reg Files, Identifying Keyloggers in Strings Listings, AppInit_DLLs, VMware Artifacts, Detailed Analysis, Searching for Vulnerable Instructions

analyzing code, Analyzing Registry Code in Practice

common functions, Analyzing Registry Code in Practice

defining services, AppInit_DLLs

for persistence, Identifying Keyloggers in Strings Listings

function for string search, Searching for Vulnerable Instructions

indications of modification, Detailed Analysis

root keys, Common Registry Functions

scripting with .reg files, Registry Scripting with .reg Files

snapshots with Regshot, Analyzing Malicious Documents

VMware artifacts in, VMware Artifacts

Registry Editor (Regedit), Common Registry Functions

Registry filter, in procmon, Filtering in Procmon

registry keys, PotentialKeylogger.exe: An Unpacked Executable, Sandbox Drawbacks, Checking NTGlobalFlag

malware and, Sandbox Drawbacks

references to debuggers, Checking NTGlobalFlag

RegMon tool, Running Malware

RegOpenKey function, Important Windows Functions

RegOpenKeyEx function, Analyzing Registry Code in Practice, Registry Scripting with .reg Files, Windows 32-Bit on Windows 64-Bit, Detailed Analysis

RegSetValueEx function, Analyzing Registry Code in Practice, Detailed Analysis

Regshot, Analyzing Malicious Documents, Using INetSim, Tools for Malware Analysis, Detailed Analysis

regular expressions, for identifying malware patterns, Network Signatures

relative addresses, vs. absolute addresses, in OllyDbg, Rebasing

relative virtual addresses (RVAs), for PE files, Parsing PE Export Data

ReleaseMutex function, Creating a Thread

.reloc section, in PE file, The PE File Headers and Sections

remote administration tool (RAT), Netcat Reverse Shells

remote hooks, Local and Remote Hooks

remote machine, program receiving commands from, Analyzing the DLL

remote process, VirtualAllocEx function and, DLL Injection

remote shell session function, Detailed Analysis

remote socket, program connecting to, Detailed Analysis

rep instructions, in x86 architecture, Branching

REP MOVSx instruction, Command-Line Option Analysis

replication, operational, Combining Dynamic and Static Analysis Techniques

resource extraction import functions, Short Answers

Resource Hacker, Examining PE Files with PEview, Tools for Malware Analysis, Detailed Analysis, Analyzing Lab10-01.sys in WinDbg, Detailed Analysis

resource section, Short Answers, Detailed Analysis

executable file stored in, Detailed Analysis

loading data from, Short Answers

resources, Short Answers, Detailed Analysis

imports for manipulating, Short Answers

obfuscated with single-byte XOR encoding, Detailed Analysis

resources management, processes for, Basic DLL Structure

ResumeThread function, Process Replacement, Important Windows Functions

ret instruction, The Stack, The Tail Jump, Position-Independent Code

retn instruction, Adding Missing Code Cross-References in IDA Pro, Lab 18-5 Solutions

return instruction, for tail jump, push instruction with, WinUpack

return pointer, abuse, Adding Missing Code Cross-References in IDA Pro

rev keyword, in Snort, Intrusion Detection with Snort

reverse IP lookups, Getting IP Address and Domain Information

reverse shell, Downloaders and Launchers, Reverse Shell Analysis, Detailed Analysis

analysis, Reverse Shell Analysis

creating, Detailed Analysis

reverse-engineering, Basic Dynamic Analysis, Monitoring with Netcat, Levels of Abstraction

in x86 disassembly, Levels of Abstraction

network protocols, Monitoring with Netcat

reverse-engineering environment, Tools for Malware Analysis

reversible cipher, XOR

RFID (radio-frequency identification) tokens, GINA Interception

right rotation (ror), Arithmetic

Rijndael algorithm, Short Answers

RIP-relative addressing, Differences in x64 Architecture

RIRs (Regional Internet Registries), Getting IP Address and Domain Information

Ritchie, Dennis, The C Programming Language, Recognizing C Code Constructs in Assembly

Robin, John, Bypassing VMware Artifact Searching

RobTex, Getting IP Address and Domain Information

rogue byte, Impossible Disassembly

ROL encoding algorithm, Identifying XOR Loops in IDA Pro

rol instruction, Arithmetic

Roman Empire, Caesar cipher and, The Goal of Analyzing Encoding Algorithms

root key, in registry, The Windows Registry

rootkits, Types of Malware, Finding Driver Objects, Rootkit Analysis in Practice, Using SeDebugPrivilege, Detailed Analysis

finding, Detailed Analysis

interrupts and, Rootkit Analysis in Practice

user-mode rootkits, Using SeDebugPrivilege

ROR encoding algorithm, Identifying XOR Loops in IDA Pro

ror instruction, Arithmetic

ROT encoding algorithm, Identifying XOR Loops in IDA Pro

rotation, instruction for, Arithmetic

.rsrc section, in PE file, The PE File Headers and Sections, Examining PE Files with PEview

RtlCompareMemory function, Examining the Hook Function

RtlCreateRegistryKey function, Important Windows Functions, Short Answers, Analyzing Lab10-01.sys in WinDbg

RtlInitUnicodeString function, Looking at the Kernel-Mode Code, Hiding Files

RtlWriteRegistryValue function, Important Windows Functions, Short Answers, Analyzing Lab10-01.sys in WinDbg

rtutils.dll, comparing trojanized and clean versions, SvcHost DLLs

rule options, in Snort, Intrusion Detection with Snort

Run subkey, for running programs automatically, Common Registry Functions

run trace, in OllyDbg, Standard Back Trace

rundll32.exe, Sandbox Drawbacks, Sandbox Drawbacks, Detailed Analysis, Detailed Analysis

filter for process, Detailed Analysis

for running DLL malware, Sandbox Drawbacks

running process, attaching OllyDbg to, Opening an Executable

running services, listing, Interprocess Coordination with Mutexes

runtime linking, Portable Executable File Format

RVAs (relative virtual addresses), for PE files, Parsing PE Export Data