| Foreword |
|
xv | |
| Acknowledgments |
|
xvii | |
| Introduction |
|
xix | |
| Part I Malware Blueprint |
|
|
Chapter 1 Malware Analysis 101 |
|
|
3 | (22) |
|
|
|
4 | (16) |
|
Malware Analysis and Reverse Engineering |
|
|
5 | (1) |
|
Types of Malware Analysis |
|
|
5 | (3) |
|
Purpose of Malware Analysis |
|
|
8 | (3) |
|
Limitations of Malware Analysis |
|
|
11 | (2) |
|
The Malware Analysis Process |
|
|
13 | (7) |
|
The Effective Malware Analyst |
|
|
20 | (2) |
|
Familiarization with Malware |
|
|
21 | (1) |
|
Familiarization with Analysis Tools |
|
|
21 | (1) |
|
|
|
22 | (1) |
|
|
|
22 | (3) |
|
Chapter 2 Malware Taxonomy |
|
|
25 | (24) |
|
|
|
26 | (21) |
|
|
|
28 | (9) |
|
|
|
37 | (3) |
|
|
|
40 | (1) |
|
|
|
40 | (1) |
|
|
|
40 | (1) |
|
|
|
41 | (1) |
|
|
|
42 | (1) |
|
|
|
43 | (1) |
|
|
|
44 | (1) |
|
|
|
45 | (2) |
|
|
|
47 | (2) |
|
Chapter 3 Malware Deployment |
|
|
49 | (18) |
|
Malware Infection Vectors |
|
|
51 | (3) |
|
|
|
51 | (1) |
|
|
|
52 | (1) |
|
|
|
53 | (1) |
|
|
|
54 | (1) |
|
Types of Malware Infection Vectors |
|
|
54 | (11) |
|
|
|
55 | (1) |
|
|
|
56 | (1) |
|
Instant Messaging and Chat |
|
|
57 | (1) |
|
|
|
58 | (2) |
|
|
|
60 | (1) |
|
|
|
61 | (1) |
|
|
|
61 | (4) |
|
Potential Infection Vectors |
|
|
65 | (1) |
|
|
|
65 | (2) |
|
Chapter 4 Protective Mechanisms |
|
|
67 | (22) |
|
The Two States of Malware |
|
|
68 | (2) |
|
|
|
69 | (1) |
|
|
|
69 | (1) |
|
|
|
70 | (17) |
|
Static Malware Protective Mechanisms |
|
|
71 | |
|
Dynamic Malware Protective Mechanisms |
|
|
19 | (68) |
|
|
|
87 | (2) |
|
Chapter 5 Malware Dependencies |
|
|
89 | (20) |
|
|
|
91 | (15) |
|
|
|
92 | (4) |
|
|
|
96 | (2) |
|
|
|
98 | (1) |
|
|
|
99 | (1) |
|
|
|
100 | (5) |
|
|
|
105 | (1) |
|
|
|
106 | (3) |
| Part II Malware Research Lab |
|
|
Chapter 6 Malware Collection |
|
|
109 | (38) |
|
|
|
111 | (9) |
|
|
|
112 | (1) |
|
|
|
113 | (1) |
|
|
|
114 | (3) |
|
Inspect Running Processes |
|
|
117 | (1) |
|
|
|
118 | (2) |
|
|
|
120 | (17) |
|
|
|
120 | (2) |
|
|
|
122 | (1) |
|
|
|
123 | (1) |
|
|
|
124 | (1) |
|
|
|
124 | (2) |
|
|
|
126 | (1) |
|
|
|
127 | (1) |
|
|
|
127 | (5) |
|
|
|
132 | (1) |
|
|
|
132 | (2) |
|
|
|
134 | (1) |
|
|
|
134 | (3) |
|
|
|
137 | (1) |
|
|
|
138 | (1) |
|
|
|
138 | (1) |
|
|
|
139 | (5) |
|
|
|
140 | (4) |
|
|
|
144 | (1) |
|
|
|
145 | (2) |
|
Chapter 7 Static Analysis Lab |
|
|
147 | (40) |
|
|
|
148 | (3) |
|
Host File Inspection Tools |
|
|
149 | (1) |
|
Mitigate Possible Infection |
|
|
149 | (1) |
|
Mitigate Becoming a Malware Staging Point |
|
|
150 | (1) |
|
|
|
150 | (1) |
|
|
|
151 | |
|
|
|
151 | (1) |
|
Install the Operating System |
|
|
152 | (11) |
|
|
|
163 | (9) |
|
|
|
172 | (6) |
|
|
|
178 | |
|
The Virtualized Static Analysis Lab |
|
|
118 | (64) |
|
|
|
182 | (1) |
|
|
|
183 | (1) |
|
|
|
184 | (3) |
|
Chapter 8 Dynamic Analysis Lab |
|
|
187 | (44) |
|
|
|
188 | (27) |
|
|
|
189 | (1) |
|
Install the Operating System |
|
|
190 | (8) |
|
Make the Lab Malware Friendly |
|
|
198 | (16) |
|
|
|
214 | (1) |
|
|
|
214 | (1) |
|
Restoring to a Clean State |
|
|
215 | (3) |
|
Virtualized Environment Clean State Restoration |
|
|
215 | (2) |
|
Bare-Metal Environment Clean State Restoration |
|
|
217 | (1) |
|
|
|
218 | (8) |
|
|
|
218 | (1) |
|
|
|
219 | (1) |
|
Other Systems Supporting the Lab |
|
|
220 | (6) |
|
|
|
226 | (1) |
|
|
|
226 | (5) |
| Part III Malware Inspection |
|
|
Chapter 9 The Portable Executable File |
|
|
231 | (38) |
|
The Windows Portable Executable File |
|
|
233 | (35) |
|
|
|
235 | (24) |
|
|
|
259 | (1) |
|
|
|
260 | (3) |
|
|
|
263 | (4) |
|
|
|
267 | (1) |
|
|
|
268 | (1) |
|
|
|
268 | (1) |
|
Chapter 10 The Proper Way to Handle Files |
|
|
269 | (28) |
|
File's Analysis Life Cycle |
|
|
270 | (25) |
|
|
|
271 | (19) |
|
|
|
290 | (1) |
|
|
|
290 | (5) |
|
|
|
295 | (1) |
|
|
|
295 | (2) |
|
Chapter 11 Inspecting Static Malware |
|
|
297 | (20) |
|
Static Analysis Techniques |
|
|
298 | (17) |
|
|
|
299 | (1) |
|
|
|
300 | (3) |
|
|
|
303 | (7) |
|
Protective Mechanisms Identification |
|
|
310 | (3) |
|
PE Structure Verification |
|
|
313 | (1) |
|
|
|
313 | (2) |
|
|
|
315 | (1) |
|
|
|
315 | (2) |
|
Chapter 12 Inspecting Dynamic Malware |
|
|
317 | (38) |
|
|
|
318 | (1) |
|
|
|
319 | (33) |
|
|
|
319 | (29) |
|
Analyzing Network Behavior |
|
|
348 | (4) |
|
Dynamic Analysis Limitations |
|
|
352 | (1) |
|
|
|
353 | (1) |
|
|
|
353 | (2) |
|
Chapter 13 Tools of the Trade |
|
|
355 | (132) |
|
Malware Analysis Use Cases |
|
|
356 | (1) |
|
|
|
357 | (1) |
|
|
|
357 | (125) |
|
|
|
357 | (1) |
|
|
|
358 | (6) |
|
|
|
364 | (3) |
|
|
|
367 | (2) |
|
|
|
369 | (1) |
|
|
|
369 | (1) |
|
|
|
370 | (1) |
|
|
|
371 | (34) |
|
|
|
405 | (1) |
|
|
|
406 | (1) |
|
|
|
407 | (62) |
|
|
|
469 | (11) |
|
Free Online Automated Sandbox Services |
|
|
480 | (2) |
|
|
|
482 | (1) |
|
|
|
483 | |
| Part IV Appendixes |
|
|
|
|
487 | (8) |
|
Appendix B List of Laboratories |
|
|
495 | (4) |
|
Appendix C Volatility Framework Basic Plug-ins |
|
|
499 | (6) |
| Index |
|
505 | |