Table of Contents for

Practical Malware Analysis

S

safe environment, Malware Analysis in Virtual Machines

(see also virtual machines)

SafeSEH, Misusing Structured Exception Handlers

SAM (Security Account Manager), password hashes of local user accounts, GINA Interception

SamIConnect function, Hash Dumping, Important Windows Functions

SamIGetPrivateData function, Hash Dumping, Important Windows Functions

SamQueryInformationUse function, Important Windows Functions

SamrQueryInformationUser function, Hash Dumping

samsrv.dll library, obtaining handle to, Hash Dumping

sandboxes, Basic Dynamic Analysis, Tools for Malware Analysis

Sandboxie, Tools for Malware Analysis

sc command, Detailed Analysis

scareware, Types of Malware

scasb instruction, Rep Instructions

scasx instruction, Branching

ScoopyNG, Using ScoopyNG

screen capture, function for, Detailed Analysis

ScreenEA function, Using IDC Scripts

scriptable debugging, in OllyDbg, Bookmarks

scripts, IDC, Extending IDA with Plug-ins

searching, Jump to Location, Setting Breakpoints, DLL Load-Order Hijacking

default order for loading DLLs in Windows XP, DLL Load-Order Hijacking

for symbols, Setting Breakpoints

in IDA Pro, Jump to Location

Section Hop, Rebuilding the Import Table with Import Reconstructor

Secure Hash Algorithm 1 (SHA-1), Antivirus Scanning: A Useful First Step

Security Account Manager (SAM), password hashes of local user accounts, GINA Interception

security descriptor, Privilege Escalation

SeDebugPrivilege privilege-escalation procedure, Detailed Analysis

segment registers, Registers

SEH (Structured Exception Handling), CLSIDs, IIDs, and the Use of COM Objects, Misusing Structured Exception Handlers, Misusing Structured Exception Handlers, Detailed Analysis

chain, Misusing Structured Exception Handlers

misusing, Misusing Structured Exception Handlers

Seitz, Justin, Gray Hat Python, Scriptable Debugging

self-decoding, Identifying Custom Encoding

self-deletion scripting code, Detailed Analysis

send function, Berkeley Compatible Sockets, The Server and Client Sides of Networking, Understanding Surrounding Code, Important Windows Functions, Detailed Analysis

installing inline hook, Detailed Analysis

sending data, and code analysis, Understanding Surrounding Code

server side of network, The Server and Client Sides of Networking

ServiceMain function, Short Answers

services, Interprocess Coordination with Mutexes, AppInit_DLLs, Detailed Analysis, Detailed Analysis, Short Answers, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis

defining in Registry, AppInit_DLLs

function creating, Detailed Analysis

functions indicating creation, Short Answers

handles for, OpenService function for, Detailed Analysis

in Windows, Interprocess Coordination with Mutexes

malware creation, Detailed Analysis

malware installed as, Detailed Analysis

program creating, Detailed Analysis

sc command for information about, Detailed Analysis

SetColor function, Using IDC Scripts

setdll tool, Detours

SetFilePointer function, Detailed Analysis

SetFileTime function, Important Windows Functions

SetThreadContext function, Process Replacement, Important Windows Functions, Detailed Analysis, Detailed Analysis

SetWaitableTimer function, Detailed Analysis

SetWindowsHookEx function, PotentialKeylogger.exe: An Unpacked Executable, User-Space Keyloggers, Local and Remote Hooks, Thread Targeting, Important Windows Functions, Detailed Analysis

SetWindowText function, PotentialKeylogger.exe: An Unpacked Executable

SF (sign) flag, General Registers

SfcTerminateWatcherThread function, Important Windows Functions, Detailed Analysis

sfc_os.dll, Detailed Analysis

sgdt instruction, Vulnerable Instructions, Using the Red Pill Anti-VM Technique

and VMware detection, Using the Red Pill Anti-VM Technique

virtual machine and, Vulnerable Instructions

SHA-1 (Secure Hash Algorithm 1), Antivirus Scanning: A Useful First Step

shared files, Files Accessible via Namespaces

shared folders, Taking Snapshots, Tweaking Settings

in VMware, Tweaking Settings

shell, connecting pipe to output, Detailed Analysis

Shell32.dll, PotentialKeylogger.exe: An Unpacked Executable

shellcode, NOP Sleds, 64-Bit Malware, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis

64-bit version, 64-Bit Malware

decoder with alphabetic encoding, Detailed Analysis

finding, NOP Sleds

hash array, Detailed Analysis

locating open handle to PDF, Detailed Analysis

payload, Detailed Analysis

writing into cisvc.exe, Detailed Analysis

shellcode analysis, Patching, Shellcode Analysis, Shellcode Analysis, Shellcode Analysis, Position-Independent Code, Using fnstenv, Using fnstenv, Finding kernel32.dll in Memory, Parsing PE Export Data, A Full Hello World Example, Shellcode Encodings, Labs, Short Answers, Detailed Analysis

dynamic, Detailed Analysis

encodings, A Full Hello World Example

identifying execution location, Position-Independent Code

in OllyDbg, Patching

labs, Labs, Short Answers

solutions, Short Answers

loading code for, Shellcode Analysis

manual symbol resolution, Using fnstenv, Using fnstenv, Finding kernel32.dll in Memory, Parsing PE Export Data

finding kernel32.dll in memory, Using fnstenv

parsing PE export data, Finding kernel32.dll in Memory

using hashed exported names, Parsing PE Export Data

NOP sled, Shellcode Encodings

position-independent code (PIC), Shellcode Analysis

shellcode_launcher.exe, Shellcode Analysis, Using call/pop, Short Answers

ShellExecute function, Important Windows Functions, Detailed Analysis

shifting registers, Arithmetic

shl instruction, Arithmetic, Arithmetic

ShowWindow function, PotentialKeylogger.exe: An Unpacked Executable

shr instruction, Arithmetic

sid keyword, in Snort, Intrusion Detection with Snort

sidt instruction (Red Pill), Vulnerable Instructions, Using the Red Pill Anti-VM Technique, Short Answers, The sidt Instruction—Red Pill

virtual machine and, Vulnerable Instructions

signature-based IDSs, Getting IP Address and Domain Information

signatures, The Goals of Malware Analysis (see network signatures)

simple ciphers, The Goal of Analyzing Encoding Algorithms, The Goal of Analyzing Encoding Algorithms, XOR, Identifying XOR Loops in IDA Pro, Other Simple Encoding Schemes

Base64, Other Simple Encoding Schemes

Caesar cipher, The Goal of Analyzing Encoding Algorithms

other encoding schemes, Identifying XOR Loops in IDA Pro

XOR cipher, XOR

simple instructions, in x86 architecture, Flags

single-byte XOR encoding, XOR

single-stepping, Kernel vs. User-Mode Debugging, Exceptions, Executing Code, Inserting INT 3

and icebp instruction, Inserting INT 3

in debuggers, Kernel vs. User-Mode Debugging, Exceptions

in OllyDbg, Executing Code

sinkhole, Malware-Focused Network Signatures

Size of Raw Data, Examining PE Files with PEview

SizeOfRawData field, in PE header, PE Header Vulnerabilities

SizeofResource function, Launchers, Detailed Analysis, Detailed Analysis

sldt instruction (No Pill), Using the Red Pill Anti-VM Technique, Short Answers, The str Instruction

and VMware detection, Using the Red Pill Anti-VM Technique

Sleep function, Using a Malware Sandbox, User-Space Keyloggers, APC Injection, Understanding Anti-Disassembly, Detailed Analysis, Detailed Analysis, Detailed Analysis

in loop, Detailed Analysis

parameter for, Detailed Analysis

sandboxes and, Using a Malware Sandbox

Sleuth Kit, The (TSK), Tools for Malware Analysis

smart cards, GINA Interception

snapshots, Connecting and Disconnecting Peripheral Devices, Analyzing Malicious Documents, Basic Dynamic Tools in Practice, Detailed Analysis

comparing with Regshot, Analyzing Malicious Documents, Basic Dynamic Tools in Practice

of registry, Detailed Analysis

of virtual machines, Connecting and Disconnecting Peripheral Devices

Snort, Intrusion Detection with Snort, Taking a Deeper Look, Taking a Deeper Look, Identifying and Leveraging the Encoding Steps, Analyze the Parsing Routines, Analyze the Parsing Routines, Tools for Malware Analysis, Network Signatures

analyzing parsing routines, Analyze the Parsing Routines

creating signature, Identifying and Leveraging the Encoding Steps

false positives in, Taking a Deeper Look

intrusion detection with, Intrusion Detection with Snort

Perl Compatible Regular Expression (PCRE) notation in, Taking a Deeper Look

signature for rule, Network Signatures

targeting multiple elements, Analyze the Parsing Routines

sockaddr_in structure, Decoding XOR Encoded Strings, Detailed Analysis

socket function, Berkeley Compatible Sockets, The Server and Client Sides of Networking, Understanding Surrounding Code, Detailed Analysis

symbolic constants for, Detailed Analysis

sockets, Berkeley Compatible Sockets, Detailed Analysis, Detailed Analysis

Berkeley compatible, Berkeley Compatible Sockets

code for creating, Detailed Analysis

program connecting to remote, Detailed Analysis

SoftICE, Debugging

software breakpoints, Breakpoints, INT Scanning, Lab 18-3 Solutions

in OllyDbg, Breakpoints

vs. hardware, Lab 18-3 Solutions

Software Data Execution Prevention Software (DEP), Misusing Structured Exception Handlers

software, modifying execution with debugger, Common Exceptions

source-level debuggers, vs. assembly-level, Debugging

spam-sending malware, Types of Malware

spear-phishing, Indications of Malicious Activity

special files, in Windows API, Files Accessible via Namespaces

sprintf function, annotated code for arguments, Detailed Analysis

spyware, PotentialKeylogger.exe: An Unpacked Executable

SSDT (System Service Descriptor Table), Finding Driver Objects, Rootkits

checking for, Rootkits

hooking, Finding Driver Objects

stack, Main Memory, The Stack, The Stack, Function Calls, Global vs. Local Variables, Absolute vs. Relative Addresses, Misusing Structured Exception Handlers, Creating and Destroying Objects, Differences in x64 Architecture, Detailed Analysis, Detailed Analysis

addresses for local variables, Global vs. Local Variables

ExceptionHandler code and, Misusing Structured Exception Handlers

fixing for function, Detailed Analysis

identifying parameters pushed onto, Detailed Analysis

in x64 architecture, differences in usage, Differences in x64 Architecture

in x86 architecture, The Stack, The Stack, Function Calls

function calls, The Stack

layout, Function Calls

objects created on, Creating and Destroying Objects

viewing in OllyDbg, Absolute vs. Relative Addresses

stack overflow, Exceptions: When Things Go Wrong

stack pointer, negative number for, Thwarting Stack-Frame Analysis

stack variables, automatically naming, Enhancing Disassembly

Stack window, in OllyDbg, The OllyDbg Interface

stack-formed strings, decoding, Short Answers

stack-frame analysis, thwarting, Thwarting Stack-Frame Analysis

standard back trace, in OllyDbg, Loading DLLs

StartAddress function, Detailed Analysis

StartService function, Services, Short Answers, Detailed Analysis, Analyzing Lab10-01.sys in WinDbg

StartServiceCtrlDispatcher function, Important Windows Functions, Detailed Analysis

STARTUPINFO structure, Creating a New Process, Netcat Reverse Shells, Reverse Shell Analysis

manipulating, Reverse Shell Analysis

START_PENDING, as service status, Detailed Analysis

static analysis, The Goals of Malware Analysis, Basic Dynamic Analysis, Basic Static Techniques, Imported Functions, Labs, A Crash Course in x86 Disassembly, Taking a Deeper Look, Tools for Malware Analysis, Solutions to Labs, Detailed Analysis

advanced, Basic Dynamic Analysis

basic, The Goals of Malware Analysis

combining with dynamic analysis, Taking a Deeper Look

Dependency Walker for, Tools for Malware Analysis

example, PotentialKeylogger.exe, Imported Functions

labs, Labs, Solutions to Labs

solutions, Solutions to Labs

techniques, Detailed Analysis

static IP addresses, Network Signatures

static libraries, The Server and Client Sides of Networking

static linking, Portable Executable File Format

static unpacking programs, automated, Automated Unpacking

static values in memory, Main Memory

status flags, Registers

STATUS_BREAKPOINT exception, Using Exceptions

stdcall calling convention, Push vs. Move

stepping, in OllyDbg, Executing Code

stepping-into, in debuggers, Single-Stepping

stepping-over, in debuggers, Single-Stepping, Executing Code

Storm worm, Using the Red Pill Anti-VM Technique

stosx instruction, Branching

str instruction, Querying the I/O Communication Port, Querying the I/O Communication Port, Short Answers, The sidt Instruction—Red Pill

and virtual machine detection, Querying the I/O Communication Port

to detect VMware, Querying the I/O Communication Port

strcat function, risk in using, A Full Hello World Example

strcpy function, risk in using, A Full Hello World Example

stricmp function, Analyzing the EXE

string instructions, Branching

strings, Finding Strings, Using the Verify Option, Common Cryptographic Algorithms, Using the Windows API, Detailed Analysis, Detailed Analysis, Detailed Analysis, Detailed Analysis, Short Answers, Filename Check, Detailed Analysis, Detailed Analysis, Searching for Vulnerable Instructions, Detailed Analysis

comparing in Process Explorer, Using the Verify Option

comparison of malware names, Detailed Analysis

concatenation functions, Detailed Analysis

decoding stack-formed, Short Answers

decoding XOR encoded, Filename Check

finding, Finding Strings

finding anti-VM techniques using, Searching for Vulnerable Instructions

functions for manipulating, Detailed Analysis

in malware, Detailed Analysis

obfuscated comparison, Detailed Analysis

packed files and, Detailed Analysis

Python script for converting data to, Detailed Analysis

recognizing in cryptographic algorithms, Common Cryptographic Algorithms

sending to debugger for display, Using the Windows API

strings listings, identifying keyloggers in, User-Space Keyloggers

Strings tool, Finding Strings, Tools for Malware Analysis

to search executable, Finding Strings

Strings window, in IDA Pro, Useful Windows for Analysis

strncmp function, DLL Injection, Analyzing the DLL, Analyzing the DLL, Detailed Analysis, Detailed Analysis, Detailed Analysis

for module name comparison, Detailed Analysis

in OllyDbg, Detailed Analysis

strncpy function, Detailed Analysis

strrchr function, Decoding Stack-Formed Strings, Detailed Analysis

strstr function, Detailed Analysis

Structured Exception Handling (SEH), CLSIDs, IIDs, and the Use of COM Objects, Misusing Structured Exception Handlers, Misusing Structured Exception Handlers, Detailed Analysis

chain, Misusing Structured Exception Handlers

misusing, Misusing Structured Exception Handlers

structures, Identifying Structs, Creating a New Process, Searching for Symbols, Viewing Structure Information, Looking at the Kernel-Mode Code, Netcat Reverse Shells, Using the Windows API, Finding kernel32.dll in Memory, Finding kernel32.dll in Memory, Detailed Analysis, Detailed Analysis, Decoding XOR Encoded Strings, Using the Memory Map to Locate DLLs, Using the Memory Map to Locate DLLs, Analyzing the Functions of the Major Function Table, Analyzing the Functions of the Major Function Table, Analyzing the Functions of the Major Function Table, Detailed Analysis, Detailed Analysis

applying in IDA Pro, Using the Memory Map to Locate DLLs

AT_INFO, Using the Memory Map to Locate DLLs

EPROCESS, Analyzing the Functions of the Major Function Table, Analyzing the Functions of the Major Function Table

changing, Analyzing the Functions of the Major Function Table

examining in WinDbg, Analyzing the Functions of the Major Function Table

identifying, Identifying Structs

InInitializationOrderLinks list of, Finding kernel32.dll in Memory

LIST_ENTRY, Finding kernel32.dll in Memory, Analyzing the Functions of the Major Function Table

manually checking, Using the Windows API

Microsoft symbols and viewing information on, Searching for Symbols

overlaying data onto, Viewing Structure Information

sockaddr_in, Decoding XOR Encoded Strings, Detailed Analysis

STARTUPINFO, Creating a New Process, Netcat Reverse Shells, Detailed Analysis

SYSTEMTIME, Detailed Analysis

time-related, manipulating, Detailed Analysis

UNICODE_STRING, for Windows kernel, Looking at the Kernel-Mode Code

Structures window, in IDA Pro, Useful Windows for Analysis

SUB encoding algorithm, Identifying XOR Loops in IDA Pro

sub links, in IDA Pro, Using Links and Cross-References

subkey, in registry, The Windows Registry

subtraction, instruction for, Simple Instructions

suspended process, resuming, Detailed Analysis

suspended state, creating process in, Process Replacement

SuspendThread function, Important Windows Functions

SvcHost DLLs, AppInit_DLLs

svchost.exe,, DLL Injection, Detailed Analysis, Detailed Analysis

malware launch from, Detailed Analysis

running as orphaned process, Detailed Analysis

switch statement, If Style, If Style, Jump Table, Jump Table, Detailed Analysis, Detailed Analysis, Detailed Analysis

graph indicating, Detailed Analysis

if style for, If Style, Jump Table

jump table for, Jump Table, Detailed Analysis

symbolic constants, for socket function, Detailed Analysis

symbolic links, creating, Analyzing the Executable in IDA Pro

symbols, Setting Breakpoints, Setting Breakpoints, Searching for Symbols, Configuring Windows Symbols

and viewing structure information, Searching for Symbols

configuring, Configuring Windows Symbols

searching for, Setting Breakpoints

SYSCALL instruction, Exceptions: When Things Go Wrong, Finding Driver Objects

SYSENTER instruction, Exceptions: When Things Go Wrong

Sysinternals, Autoruns program, Identifying Keyloggers in Strings Listings

SYSTEM account, Interprocess Coordination with Mutexes

system binaries, trojanized, for persistence, SvcHost DLLs

system calls, filtering on, Filtering in Procmon

system function, Important Windows Functions

system memory, Global vs. Local Variables (see memory)

system residue, checking for, Checking NTGlobalFlag

System Service Descriptor Table (SSDT), Finding Driver Objects, Rootkits

checking for, Rootkits

hooking, Finding Driver Objects

SystemFunction025 function, Hash Dumping

SystemFunction027 function, Hash Dumping

SYSTEMTIME structure, Detailed Analysis

SystemTimeToFileTime function, Detailed Analysis