Table of Contents for

Practical Malware Analysis

T

tail jump, The Tail Jump, Using Automated Tools to Find the OEP, WinUpack, Lab 18-3 Solutions, Lab 18-5 Solutions

and finding OEP, Using Automated Tools to Find the OEP

eliminating code as, Lab 18-5 Solutions

examining code for, Lab 18-3 Solutions

for program packed with UPack, WinUpack

targeted malware, Types of Malware

targeted phishing, Indications of Malicious Activity

TCP handshake, capturing, Basic Dynamic Tools in Practice

TCPView, Tools for Malware Analysis

TEB (Thread Environment Block), Misusing Structured Exception Handlers

TerminateProcess function, IAT hooking of, Covering Its Tracks—User-Mode Rootkits

test instruction, Stack Layout

.text section, in PE file, PotentialKeylogger.exe: An Unpacked Executable, The PE File Headers and Sections

text mode, in IDA Pro, Graph Mode

TF (trap) flag, General Registers

The Sleuth Kit (TSK), Tools for Malware Analysis

Themida, WinUpack

Thinking in C++ (Eckel), Object-Oriented Programming

this pointer, Object-Oriented Programming, The this Pointer, Detailed Analysis, Detailed Analysis

in disassembly, The this Pointer

thread context, Creating a New Process

Thread Environment Block (TEB), Misusing Structured Exception Handlers

thread identifiers (TID), Detailed Analysis

Thread Information Block (TIB), Misusing Structured Exception Handlers

thread local storage (TLS) callbacks, Using QueryPerformanceCounter and GetTickCount

Thread32First function, Important Windows Functions

Thread32Next function, Important Windows Functions

threads, Creating a New Process, Absolute vs. Relative Addresses, Thread Targeting, Detailed Analysis

in Windows, Creating a New Process

program accessing context of, Detailed Analysis

targeting, Thread Targeting

viewing in OllyDbg, Absolute vs. Relative Addresses

ThreatExpert, Basic Dynamic Analysis

TIB (Thread Information Block), Misusing Structured Exception Handlers

TID (thread identifiers), Detailed Analysis

Time Date Stamp description, in PE file, The PE File Headers and Sections

time-related structures, manipulating, Detailed Analysis

timestomping, Detailed Analysis

timing checks, INT Scanning, The QueryPerformanceCounter Function, The QueryPerformanceCounter Function, The GetTickCount Function

GetTickCount function, The QueryPerformanceCounter Function

rdtsc function, The GetTickCount Function

with QueryPerformanceCounter, The QueryPerformanceCounter Function

TLS (thread local storage) callbacks, Using QueryPerformanceCounter and GetTickCount

Toolhelp32ReadProcessMemory function, Important Windows Functions

Tor, OPSEC = Operations Security, Tools for Malware Analysis

tracing, in OllyDbg, Loading DLLs

traffic logs, of malware activities, Understanding Surrounding Code

transferring files, from virtual machine, Taking Snapshots

trap flag, Exceptions

trojanized system binaries, for persistence, SvcHost DLLs

Truman, Tools for Malware Analysis

TSK (The Sleuth Kit), Tools for Malware Analysis

type library, loading manually in IDA Pro, Using Named Constants

types, in Windows API, Handles