Table of Contents for

Practical Malware Analysis

U

u (unassemble) command, in WinDbg, Setting Breakpoints

Ultimate Packer for eXecutables, Detecting Packers with PEiD (see UPX (Ultimate Packer for eXecutables))

unconditional jump, Stack Layout, Detailed Analysis

undo feature, snapshots as, Connecting and Disconnecting Peripheral Devices

unescape function (JavaScript), NOP Sleds, Detailed Analysis

unhandled exception, Misusing Structured Exception Handlers

UnhookWindowsHookEx function, Thread Targeting

Unicode strings, Finding Strings

UNICODE_STRING structure, for Windows kernel, Looking at the Kernel-Mode Code

uniform resource locators (URLs), opening to download malware, Detailed Analysis, Detailed Analysis

unload function, analysis in WinDbg vs. IDA Pro, Analyzing Lab10-01.sys in WinDbg

UnMapViewOfSection function, Detailed Analysis

unpacking, Detecting Packers with PEiD, The Tail Jump, Automated Unpacking, WinUpack, Lab 18-1 Solutions

analyzing malware without, WinUpack

example, The Tail Jump

manual, Automated Unpacking

unpacking stub, Packers and Unpacking, Packer Anatomy, Automated Unpacking, WinUpack, Lab 18-5 Solutions

size of, WinUpack

UPack, Entropy Calculation, PECompact

UPX (Ultimate Packer for eXecutables), Detecting Packers with PEiD, Entropy Calculation, Automated Unpacking, Repairing the Import Table Manually, Tools for Malware Analysis, Reviewing the Final Check

packing with modified version, Reviewing the Final Check

tips and tricks, Repairing the Import Table Manually

UPX-packed malware, Detailed Analysis

URLDownloadToCacheFile function, Downloaders and Launchers, Detailed Analysis, Decrypting AES, Detailed Analysis, Detailed Analysis

URLDownloadToFile function, Understanding Surrounding Code, Important Windows Functions, Detailed Analysis

URLs (uniform resource locators), opening to download malware, Detailed Analysis, Detailed Analysis

USB flash drives, Drivers and Kernel Code

user mode, Exceptions: When Things Go Wrong, Debugging, Drivers and Kernel Code

calls from application, Drivers and Kernel Code

for debuggers, vs. kernel mode, Debugging

in Windows, Exceptions: When Things Go Wrong

user space, Configuring Windows Symbols, User-Space Keyloggers, APC Injection

APC injection from, APC Injection

keyloggers, User-Space Keyloggers

looking at code, Configuring Windows Symbols

User-Agent, Intrusion Detection with Snort, Attackers Mimic Existing Protocols, Understanding Surrounding Code, Identifying and Leveraging the Encoding Steps, Short Answers, Detailed Analysis, Detailed Analysis

dynamically generated, Short Answers

for malware, Intrusion Detection with Snort, Attackers Mimic Existing Protocols, Detailed Analysis

string for signature, Detailed Analysis

user-mode APC, APC Injection

user-mode rootkits, Using SeDebugPrivilege, Covering Its Tracks—User-Mode Rootkits, Covering Its Tracks—User-Mode Rootkits

IAT hooking, Covering Its Tracks—User-Mode Rootkits

inline hooking, Covering Its Tracks—User-Mode Rootkits

user32.dll, Exploring Dynamically Linked Functions with Dependency Walker, PotentialKeylogger.exe: An Unpacked Executable, Short Answers