Table of Contents for

Practical Malware Analysis

W

W, at end of Windows function name, Exploring Dynamically Linked Functions with Dependency Walker

WaitForMultipleObjectsEx function, APC Injection

WaitForSingleObject function, Creating a Thread

WaitForSingleObjectEx function, APC Injection

Watches window, in OllyDbg, Analyzing Shellcode

web applications, Burp Suite for testing, Tools for Malware Analysis

web browser, malware determination of default, Short Answers

WEP (Wired Equivalent Privacy), Using Your Malware Analysis Machine

while loops, Understanding Function Call Conventions

whois requests, for domains, Getting IP Address and Domain Information

whosthere-alt, Hash Dumping

WH_KEYBOARD procedures, Local and Remote Hooks

WH_KEYBOARD_LL procedures, Local and Remote Hooks

Wi-Fi Protected Access (WPA), Using Your Malware Analysis Machine

wide character string, Finding Strings

WideCharToMultiByte function, Important Windows Functions

Win32 device namespace, Files Accessible via Namespaces

WIN32_SHARE_PROCESS type, Services

WinDbg, Debugging, Kernel Debugging with WinDbg, Setting Up Kernel Debugging, Setting Up Kernel Debugging, Reading from Memory, Reading from Memory, Setting Breakpoints, Finding Driver Objects, Rootkits, Loading Drivers, Lab 10-1, Using TLS Callbacks, Tools for Malware Analysis, Applying a Structure in IDA Pro, Viewing Lab10-01.sys in IDA Pro, Analyzing Lab10-01.sys in WinDbg, Analyzing Lab10-01.sys in WinDbg, Finding the Driver in Memory with WinDbg, Analyzing the Functions of the Major Function Table, Detailed Analysis

arithmetic operators, Reading from Memory

breakpoints, Reading from Memory

connecting to virtual machine with, Setting Up Kernel Debugging

EPROCESS structure examined with, Analyzing the Functions of the Major Function Table

finding device driver in memory, Finding the Driver in Memory with WinDbg

for kernel debugger, Analyzing Lab10-01.sys in WinDbg

labs, Lab 10-1, Applying a Structure in IDA Pro

solutions, Applying a Structure in IDA Pro

loading drivers, Loading Drivers

module listing, Setting Breakpoints

output, Detailed Analysis

reading from memory, Setting Up Kernel Debugging

rootkits, Finding Driver Objects

SSDT viewed in, Rootkits

system breakpoint and, Using TLS Callbacks

viewing driver, Viewing Lab10-01.sys in IDA Pro

vs. IDA Pro, Analyzing Lab10-01.sys in WinDbg

window modes, in IDA Pro, Loading an Executable

Windows, Portable Executable File Format, The PE File Headers and Sections, The Structure of a Virtual Machine, The Server and Client Sides of Networking, The Server and Client Sides of Networking, Basic DLL Structure, Creating a New Process, Creating a Thread, Interprocess Coordination with Mutexes, Services, CLSIDs, IIDs, and the Use of COM Objects, Exceptions: When Things Go Wrong, Exceptions: When Things Go Wrong, Kernel vs. User Mode, Drivers and Kernel Code, Netcat Reverse Shells, WinUpack

as virtual OS, The Structure of a Virtual Machine

blue screen, Exceptions: When Things Go Wrong

Component Object Model (COM), Services

device drivers, Drivers and Kernel Code

executables, common sections, The PE File Headers and Sections

following running malware, The Server and Client Sides of Networking, The Server and Client Sides of Networking, Basic DLL Structure, Creating a New Process, Creating a Thread, Interprocess Coordination with Mutexes, CLSIDs, IIDs, and the Use of COM Objects

dynamic link libraries (DLLs), The Server and Client Sides of Networking

exceptions, CLSIDs, IIDs, and the Use of COM Objects

interprocess coordination with mutexes, Creating a Thread

processes, Basic DLL Structure

services, Interprocess Coordination with Mutexes

threads, Creating a New Process

functions for importing linked functions, Portable Executable File Format

kernel vs. user mode, Exceptions: When Things Go Wrong

Native API, Kernel vs. User Mode

reverse shell, Netcat Reverse Shells

tool for dumping process, WinUpack

Windows 32-bit on Windows 64-bit (WOW64) subsystem, Prologue and Epilogue 64-Bit Code

Windows 7, kernel issues in, Loading Drivers

Windows API, Using Named Constants, Handles, File System Functions, File System Functions, Files Accessible via Namespaces, Berkeley Compatible Sockets, Windows Debugger Detection, Analyzing the EXE

code calling functions, Analyzing the EXE

debugger detection with, Windows Debugger Detection

file system functions, File System Functions

handles, File System Functions

IDA Pro catalog of named constants, Using Named Constants

networking APIs, Berkeley Compatible Sockets

special files, Files Accessible via Namespaces

Windows debugger detection, Windows Debugger Detection, Windows Debugger Detection, Using the Windows API

manually checking structures, Using the Windows API

with Windows API, Windows Debugger Detection

Windows File Protection, Detailed Analysis, Detailed Analysis

Windows functions, Exploring Dynamically Linked Functions with Dependency Walker, Important Windows Functions

Ex suffix for, Exploring Dynamically Linked Functions with Dependency Walker

Windows Internet (WinINet) API, The Server and Client Sides of Networking, Understanding Surrounding Code, Detailed Analysis, Short Answers, Short Answers

advantages and disadvantages, Short Answers

Windows malware, Analyzing Malicious Windows Programs, Lab 7-1, Detailed Analysis

labs, Lab 7-1, Detailed Analysis

solutions, Detailed Analysis

Windows NT/2000 Native API Reference (Nebbett), The Native API

Windows Registry, The Windows Registry (see Registry (Windows))

Windows Sockets (Winsock) API, Understanding Surrounding Code

Windows Update binary, Detailed Analysis, Detailed Analysis, Detailed Analysis

malware creation of handler, Detailed Analysis

moving to temporary directory, Detailed Analysis

string to temporary move, Detailed Analysis

Windows virtual machine, Basic Dynamic Tools in Practice

Windows Vista, kernel issues for, Loading Drivers

Windows XP, DLL Load-Order Hijacking, Short Answers

default search order for loading DLLs, DLL Load-Order Hijacking

disabled firewall, Short Answers

WinExec function, Important Windows Functions, Detailed Analysis

WinGraph32 application, Analyzing Functions

WinHex, Tools for Malware Analysis, Detailed Analysis, Detailed Analysis

WinINet (Windows Internet) API, The Server and Client Sides of Networking, Understanding Surrounding Code, Detailed Analysis, Short Answers, Short Answers

advantages and disadvantages, Short Answers

wininet.dll, Exploring Dynamically Linked Functions with Dependency Walker, Detailed Analysis, Detailed Analysis

imports from, Detailed Analysis

Winlogon Notify, AppInit_DLLs

Winlogon, opening handle to, Detailed Analysis

WinMain function, analysis, Detailed Analysis

WinMD5 calculator, Antivirus Scanning: A Useful First Step, Finding Strings

WinObj Object Manager, Files Accessible via Namespaces

Winsock (Windows Sockets) API, Understanding Surrounding Code

Winsock libraries, Berkeley Compatible Sockets

WinUpack, PECompact, Lab 18-4 Solutions

Wired Equivalent Privacy (WEP), Using Your Malware Analysis Machine

Wireshark, Monitoring with Netcat, Packet Sniffing with Wireshark, Packet Sniffing with Wireshark, Basic Dynamic Tools in Practice, Basic Dynamic Tools in Practice, Tools for Malware Analysis, Detailed Analysis

DNS and HTTP example, Packet Sniffing with Wireshark

Follow TCP Stream window, Packet Sniffing with Wireshark

packet sniffing with, Monitoring with Netcat

reviewing capture, Basic Dynamic Tools in Practice

Witty worm, Files Accessible via Namespaces

Wlx, function names beginning with, GINA Interception

WlxLoggedOnSAS function, Important Windows Functions

Word documents, analyzing with Process Explorer, Analyzing Malicious Documents

WORD type, in Windows API, Handles

worm, Types of Malware

WOW64 (Windows 32-bit on Windows 64-bit) subsystem, Prologue and Epilogue 64-Bit Code

Wow64DisableWow64FsRedirection function, Windows 32-Bit on Windows 64-Bit, Important Windows Functions

WPA (Wi-Fi Protected Access), Using Your Malware Analysis Machine

WriteFile function, File System Functions, Configuring Windows Symbols, Looking at the Kernel-Mode Code, Detailed Analysis, Detailed Analysis

origin of handle passed to, Detailed Analysis

WriteProcessMemory function, Launchers, DLL Injection, DLL Injection, DLL Injection, NOP Sleds, Important Windows Functions, Summary, Detailed Analysis, Detailed Analysis

and direct injection, DLL Injection

and process injection, Launchers

ws2_32.dll, Exploring Dynamically Linked Functions with Dependency Walker, The Server and Client Sides of Networking, Detailed Analysis, Detailed Analysis

imports from, Detailed Analysis

WSAGetLastError function, The Server and Client Sides of Networking, Understanding Surrounding Code

WSASocket function, Filename Check, Detailed Analysis

WSAStartup function, The Server and Client Sides of Networking, Understanding Surrounding Code, Important Windows Functions, Filename Check, Detailed Analysis

wshtcpip.dll, Detailed Analysis

WSock32.dll, Exploring Dynamically Linked Functions with Dependency Walker

wupdmgr.exe, Detailed Analysis, Detailed Analysis

launching, Detailed Analysis