About the Authors |
|
xix | |
About the Technical Reviewer |
|
xx | |
About the Contributing Authors |
|
xx | |
Foreword |
|
xxi | |
|
Acknowledgments |
|
xxv | |
Individual Thanks |
|
xxv | |
Introduction |
|
xxvii | |
What Is Malware Analysis? |
|
xxviii | |
Prerequisites |
|
xxviii | |
Practical, Hands-On Learning |
|
xxix | |
What's in the Book? |
|
xxx | |
|
0 Malware Analysis Primer |
|
|
1 | (8) |
|
The Goals of Malware Analysis |
|
|
1 | (1) |
|
Malware Analysis Techniques |
|
|
2 | (1) |
|
|
2 | (1) |
|
|
2 | (1) |
|
|
3 | (1) |
|
Advanced Dynamic Analysis |
|
|
3 | (1) |
|
|
3 | (2) |
|
General Rules for Malware Analysis |
|
|
5 | (4) |
|
|
|
1 Basic Static Techniques |
|
|
9 | (20) |
|
Antivirus Scanning: A Useful First Step |
|
|
10 | (1) |
|
Hashing: A Fingerprint for Malware |
|
|
10 | (1) |
|
|
11 | (2) |
|
Packed and Obfuscated Malware |
|
|
13 | (1) |
|
|
13 | (1) |
|
Detecting Packers with PEiD |
|
|
14 | (1) |
|
Portable Executable File Format |
|
|
14 | (1) |
|
Linked Libraries and Functions |
|
|
15 | (3) |
|
Static, Runtime, and Dynamic Linking |
|
|
15 | (1) |
|
Exploring Dynamically Linked Functions with Dependency Walker |
|
|
16 | (2) |
|
|
18 | (1) |
|
|
18 | (1) |
|
Static Analysis in Practice |
|
|
18 | (3) |
|
PotentialKeylogger.exe: An Unpacked Executable |
|
|
18 | (3) |
|
PackedProgram.exe: A Dead End |
|
|
21 | (1) |
|
The PE File Headers and Sections |
|
|
21 | (5) |
|
Examining PE Files with PEview |
|
|
22 | (3) |
|
Viewing the Resource Section with Resource Hacker |
|
|
25 | (1) |
|
Using Other PE File Tools |
|
|
26 | (1) |
|
|
26 | (1) |
|
|
26 | (1) |
|
|
27 | (2) |
|
2 Malware Analysis in Virtual Machines |
|
|
29 | (10) |
|
The Structure of a Virtual Machine |
|
|
30 | (1) |
|
Creating Your Malware Analysis Machine |
|
|
31 | (3) |
|
|
31 | (3) |
|
Using Your Malware Analysis Machine |
|
|
34 | (2) |
|
Connecting Malware to the Internet |
|
|
34 | (1) |
|
Connecting and Disconnecting Peripheral Devices |
|
|
34 | (1) |
|
|
35 | (1) |
|
Transferring Files from a Virtual Machine |
|
|
36 | (1) |
|
The Risks of Using VMware for Malware Analysis |
|
|
36 | (1) |
|
Record/Replay: Running Your Computer in Reverse |
|
|
37 | (1) |
|
|
37 | (2) |
|
|
39 | (26) |
|
Sandboxes: The Quick-and-Dirty Approach |
|
|
40 | (2) |
|
|
40 | (1) |
|
|
41 | (1) |
|
|
42 | (1) |
|
Monitoring with Process Monitor |
|
|
43 | (4) |
|
|
44 | (1) |
|
|
44 | (3) |
|
Viewing Processes with Process Explorer |
|
|
47 | (3) |
|
The Process Explorer Display |
|
|
47 | (1) |
|
|
48 | (1) |
|
|
49 | (1) |
|
|
49 | (1) |
|
Analyzing Malicious Documents |
|
|
50 | (1) |
|
Comparing Registry Snapshots with Regshot |
|
|
50 | (1) |
|
|
51 | (2) |
|
|
51 | (1) |
|
|
52 | (1) |
|
Packet Sniffing with Wireshark |
|
|
53 | (2) |
|
|
55 | (1) |
|
Basic Dynamic Tools in Practice |
|
|
56 | (4) |
|
|
60 | (1) |
|
|
61 | (4) |
|
PART 2 ADVANCED STATIC ANALYSIS |
|
|
|
4 A Crash Course in X86 Disassembly |
|
|
65 | (22) |
|
|
66 | (1) |
|
|
67 | (1) |
|
|
68 | (17) |
|
|
69 | (1) |
|
|
69 | (1) |
|
|
70 | (1) |
|
|
70 | (1) |
|
|
71 | (2) |
|
|
73 | (4) |
|
|
77 | (3) |
|
|
80 | (1) |
|
|
80 | (1) |
|
|
81 | (2) |
|
C Main Method and Offsets |
|
|
83 | (2) |
|
More Information: Intel x86 Architecture Manuals |
|
|
85 | (1) |
|
|
85 | (2) |
|
|
87 | (22) |
|
|
88 | (1) |
|
|
89 | (6) |
|
|
89 | (2) |
|
Useful Windows for Analysis |
|
|
91 | (1) |
|
Returning to the Default View |
|
|
92 | (1) |
|
|
92 | (2) |
|
|
94 | (1) |
|
|
95 | (2) |
|
|
95 | (1) |
|
|
96 | (1) |
|
|
97 | (1) |
|
|
98 | (2) |
|
|
100 | (3) |
|
|
100 | (1) |
|
|
100 | (1) |
|
|
100 | (2) |
|
|
102 | (1) |
|
|
103 | (1) |
|
Extending IDA with Plug-ins |
|
|
103 | (3) |
|
|
104 | (1) |
|
|
105 | (1) |
|
Using Commercial Plug-ins |
|
|
106 | (1) |
|
|
106 | (1) |
|
|
107 | (2) |
|
6 Recognizing C Code Constructs in Assembly |
|
|
109 | (26) |
|
Global vs. Local Variables |
|
|
110 | (2) |
|
Disassembling Arithmetic Operations |
|
|
112 | (1) |
|
Recognizing if Statements |
|
|
113 | (3) |
|
Analyzing Functions Graphically with IDA Pro |
|
|
114 | (1) |
|
Recognizing Nested if Statements |
|
|
114 | (2) |
|
|
116 | (3) |
|
|
116 | (2) |
|
|
118 | (1) |
|
Understanding Function Call Conventions |
|
|
119 | (2) |
|
|
119 | (1) |
|
|
120 | (1) |
|
|
120 | (1) |
|
|
120 | (1) |
|
Analyzing switch Statements |
|
|
121 | (6) |
|
|
122 | (1) |
|
|
123 | (4) |
|
|
127 | (1) |
|
|
128 | (2) |
|
Analyzing Linked List Traversal |
|
|
130 | (2) |
|
|
132 | (1) |
|
|
133 | (2) |
|
7 Analyzing Malicious Windows Programs |
|
|
135 | (32) |
|
|
136 | (3) |
|
Types and Hungarian Notation |
|
|
136 | (1) |
|
|
137 | (1) |
|
|
137 | (1) |
|
|
138 | (1) |
|
|
139 | (4) |
|
|
140 | (1) |
|
|
140 | (1) |
|
Programs that Run Automatically |
|
|
140 | (1) |
|
Common Registry Functions |
|
|
141 | (1) |
|
Analyzing Registry Code in Practice |
|
|
141 | (1) |
|
Registry Scripting with .reg Files |
|
|
142 | (1) |
|
|
143 | (2) |
|
Berkeley Compatible Sockets |
|
|
143 | (1) |
|
The Server and Client Sides of Networking |
|
|
144 | (1) |
|
|
145 | (1) |
|
Following Running Malware |
|
|
145 | (13) |
|
|
145 | (2) |
|
|
147 | (2) |
|
|
149 | (2) |
|
Interprocess Coordination with Mutexes |
|
|
151 | (1) |
|
|
152 | (2) |
|
The Component Object Model |
|
|
154 | (3) |
|
Exceptions: When Things Go Wrong |
|
|
157 | (1) |
|
|
158 | (1) |
|
|
159 | (2) |
|
|
161 | (1) |
|
|
162 | (5) |
|
PART 3 ADVANCED DYNAMIC ANALYSIS |
|
|
|
|
167 | (12) |
|
Source-Level vs. Assembly-Level Debuggers |
|
|
168 | (1) |
|
Kernel vs. User-Mode Debugging |
|
|
168 | (1) |
|
|
169 | (6) |
|
|
169 | (1) |
|
Stepping-Over vs. Stepping-Into |
|
|
170 | (1) |
|
Pausing Execution with Breakpoints |
|
|
171 | (4) |
|
|
175 | (2) |
|
First- and Second-Chance Exceptions |
|
|
176 | (1) |
|
|
176 | (1) |
|
Modifying Execution with a Debugger |
|
|
177 | (1) |
|
Modifying Program Execution in Practice |
|
|
177 | (1) |
|
|
178 | (1) |
|
|
179 | (26) |
|
|
180 | (1) |
|
|
180 | (1) |
|
Attaching to a Running Process |
|
|
181 | (1) |
|
|
181 | (2) |
|
|
183 | (2) |
|
|
184 | (1) |
|
Viewing Threads and Stacks |
|
|
185 | (1) |
|
|
186 | (2) |
|
|
188 | (3) |
|
|
188 | (1) |
|
|
189 | (1) |
|
|
190 | (1) |
|
|
190 | (1) |
|
|
191 | (1) |
|
|
192 | (2) |
|
|
192 | (1) |
|
|
193 | (1) |
|
|
193 | (1) |
|
|
193 | (1) |
|
|
194 | (1) |
|
|
195 | (1) |
|
|
196 | (1) |
|
|
197 | (1) |
|
|
197 | (3) |
|
|
198 | (1) |
|
|
198 | (1) |
|
|
198 | (1) |
|
|
199 | (1) |
|
|
200 | (1) |
|
|
201 | (1) |
|
|
202 | (3) |
|
10 Kernel Debugging with Windbg |
|
|
205 | (26) |
|
|
206 | (1) |
|
Setting Up Kernel Debugging |
|
|
207 | (3) |
|
|
210 | (2) |
|
|
210 | (1) |
|
Using Arithmetic Operators |
|
|
211 | (1) |
|
|
211 | (1) |
|
|
212 | (1) |
|
|
212 | (3) |
|
|
212 | (1) |
|
Viewing Structure Information |
|
|
213 | (2) |
|
Configuring Windows Symbols |
|
|
215 | (1) |
|
Kernel Debugging in Practice |
|
|
215 | (6) |
|
Looking at the User-Space Code |
|
|
215 | (2) |
|
Looking at the Kernel-Mode Code |
|
|
217 | (3) |
|
|
220 | (1) |
|
|
221 | (5) |
|
Rootkit Analysis in Practice |
|
|
222 | (3) |
|
|
225 | (1) |
|
|
226 | (1) |
|
Kernel Issues for Windows Vista, Windows 7, and x64 Versions |
|
|
226 | (1) |
|
|
227 | (1) |
|
|
228 | (3) |
|
PART 4 MALWARE FUNCTIONALITY |
|
|
|
|
231 | (22) |
|
Downloaders and Launchers |
|
|
231 | (1) |
|
|
232 | (2) |
|
|
232 | (1) |
|
|
233 | (1) |
|
|
234 | (1) |
|
RATs and Botnets Compared |
|
|
234 | (1) |
|
|
234 | (7) |
|
|
235 | (1) |
|
|
236 | (2) |
|
|
238 | (3) |
|
|
241 | (4) |
|
|
241 | (2) |
|
Trojanized System Binaries |
|
|
243 | (1) |
|
|
244 | (1) |
|
|
245 | (2) |
|
|
246 | (1) |
|
Covering Its Tracks---User-Mode Rootkits |
|
|
247 | (3) |
|
|
248 | (1) |
|
|
248 | (2) |
|
|
250 | (1) |
|
|
251 | (2) |
|
12 Covert Malware Launching |
|
|
253 | (16) |
|
|
253 | (1) |
|
|
254 | (3) |
|
|
254 | (3) |
|
|
257 | (1) |
|
|
257 | (2) |
|
|
259 | (3) |
|
|
260 | (1) |
|
|
260 | (1) |
|
|
260 | (1) |
|
|
261 | (1) |
|
|
262 | (1) |
|
|
262 | (3) |
|
APC Injection from User Space |
|
|
263 | (1) |
|
APC Injection from Kernel Space |
|
|
264 | (1) |
|
|
265 | (1) |
|
|
266 | (3) |
|
|
269 | (28) |
|
The Goal of Analyzing Encoding Algorithms |
|
|
270 | (1) |
|
|
270 | (10) |
|
|
270 | (1) |
|
|
271 | (5) |
|
Other Simple Encoding Schemes |
|
|
276 | (1) |
|
|
277 | (3) |
|
Common Cryptographic Algorithms |
|
|
280 | (5) |
|
Recognizing Strings and Imports |
|
|
281 | (1) |
|
Searching for Cryptographic Constants |
|
|
282 | (1) |
|
Searching for High-Entropy Content |
|
|
283 | (2) |
|
|
285 | (3) |
|
Identifying Custom Encoding |
|
|
285 | (3) |
|
Advantages of Custom Encoding to the Attacker |
|
|
288 | (1) |
|
|
288 | (6) |
|
|
288 | (1) |
|
Manual Programming of Decoding Functions |
|
|
289 | (2) |
|
Using Instrumentation for Generic Decryption |
|
|
291 | (3) |
|
|
294 | (1) |
|
|
295 | (2) |
|
14 Malware-Focused Network Signatures |
|
|
297 | (30) |
|
|
297 | (3) |
|
Observing the Malware in Its Natural Habitat |
|
|
298 | (1) |
|
Indications of Malicious Activity |
|
|
298 | (1) |
|
OPSEC = Operations Security |
|
|
299 | (1) |
|
Safely Investigate an Attacker Online |
|
|
300 | (2) |
|
|
300 | (1) |
|
Getting IP Address and Domain Information |
|
|
300 | (2) |
|
Content-Based Network Countermeasures |
|
|
302 | (5) |
|
Intrusion Detection with Snort |
|
|
303 | (1) |
|
|
304 | (3) |
|
Combining Dynamic and Static Analysis Techniques |
|
|
307 | (14) |
|
The Danger of Overanalysis |
|
|
308 | (1) |
|
|
308 | (4) |
|
Understanding Surrounding Code |
|
|
312 | (1) |
|
Finding the Networking Code |
|
|
313 | (1) |
|
Knowing the Sources of Network Content |
|
|
314 | (1) |
|
Hard-Coded Data vs. Ephemeral Data |
|
|
314 | (1) |
|
Identifying and Leveraging the Encoding Steps |
|
|
315 | (2) |
|
|
317 | (1) |
|
Analyze the Parsing Routines |
|
|
318 | (2) |
|
Targeting Multiple Elements |
|
|
320 | (1) |
|
Understanding the Attacker's Perspective |
|
|
321 | (1) |
|
|
322 | (1) |
|
|
323 | (4) |
|
PART 5 ANTI-REVERSE-ENGINEERING |
|
|
|
|
327 | (24) |
|
Understanding Anti-Disassembly |
|
|
328 | (1) |
|
Defeating Disassembly Algorithms |
|
|
329 | (5) |
|
|
329 | (2) |
|
Flow-Oriented Disassembly |
|
|
331 | (3) |
|
Anti-Disassembly Techniques |
|
|
334 | (6) |
|
Jump Instructions with the Same Target |
|
|
334 | (2) |
|
A Jump Instruction with a Constant Condition |
|
|
336 | (1) |
|
|
337 | (3) |
|
NOP-ing Out Instructions with IDA Pro |
|
|
340 | (1) |
|
|
340 | (7) |
|
The Function Pointer Problem |
|
|
340 | (2) |
|
Adding Missing Code Cross-References in IDA Pro |
|
|
342 | (1) |
|
|
342 | (2) |
|
Misusing Structured Exception Handlers |
|
|
344 | (3) |
|
Thwarting Stack-Frame Analysis |
|
|
347 | (2) |
|
|
349 | (1) |
|
|
350 | (1) |
|
|
351 | (18) |
|
Windows Debugger Detection |
|
|
352 | (4) |
|
|
352 | (1) |
|
Manually Checking Structures |
|
|
353 | (3) |
|
Checking for System Residue |
|
|
356 | (1) |
|
Identifying Debugger Behavior |
|
|
356 | (3) |
|
|
357 | (1) |
|
Performing Code Checksums |
|
|
357 | (1) |
|
|
357 | (2) |
|
Interfering with Debugger Functionality |
|
|
359 | (4) |
|
|
359 | (2) |
|
|
361 | (1) |
|
|
362 | (1) |
|
|
363 | (2) |
|
PE Header Vulnerabilities |
|
|
363 | (2) |
|
The OutputDebugString Vulnerability |
|
|
365 | (1) |
|
|
365 | (2) |
|
|
367 | (2) |
|
17 Anti-Virtual Machine Techniques |
|
|
369 | (14) |
|
|
370 | (3) |
|
Bypassing VMware Artifact Searching |
|
|
372 | (1) |
|
Checking for Memory Artifacts |
|
|
373 | (1) |
|
|
373 | (6) |
|
Using the Red Pill Anti-VM Technique |
|
|
374 | (1) |
|
Using the No Pill Technique |
|
|
375 | (1) |
|
Querying the I/O Communication Port |
|
|
375 | (2) |
|
Using the str Instruction |
|
|
377 | (1) |
|
|
377 | (1) |
|
Highlighting Anti-VM in IDA Pro |
|
|
377 | (2) |
|
|
379 | (1) |
|
|
379 | (1) |
|
Escaping the Virtual Machine |
|
|
380 | (1) |
|
|
380 | (1) |
|
|
381 | (2) |
|
|
383 | (24) |
|
|
384 | (3) |
|
|
384 | (1) |
|
|
384 | (1) |
|
|
385 | (1) |
|
|
386 | (1) |
|
|
386 | (1) |
|
Identifying Packed Programs |
|
|
387 | (1) |
|
Indicators of a Packed Program |
|
|
387 | (1) |
|
|
387 | (1) |
|
|
388 | (1) |
|
|
388 | (1) |
|
|
389 | (8) |
|
Rebuilding the Import Table with Import Reconstructor |
|
|
390 | (1) |
|
|
391 | (4) |
|
Repairing the Import Table Manually |
|
|
395 | (2) |
|
Tips and Tricks for Common Packers |
|
|
397 | (3) |
|
|
397 | (1) |
|
|
397 | (1) |
|
|
398 | (1) |
|
|
398 | (1) |
|
|
398 | (2) |
|
|
400 | (1) |
|
Analyzing Without Fully Unpacking |
|
|
400 | (1) |
|
|
401 | (1) |
|
|
402 | (1) |
|
|
403 | (4) |
|
|
|
|
407 | (20) |
|
Loading Shellcode for Analysis |
|
|
408 | (1) |
|
Position-Independent Code |
|
|
408 | (1) |
|
Identifying Execution Location |
|
|
409 | (4) |
|
|
409 | (2) |
|
|
411 | (2) |
|
|
413 | (5) |
|
Finding kernel32.dll in Memory |
|
|
413 | (2) |
|
|
415 | (2) |
|
Using Hashed Exported Names |
|
|
417 | (1) |
|
A Full Hello World Example |
|
|
418 | (3) |
|
|
421 | (1) |
|
|
422 | (1) |
|
|
423 | (1) |
|
|
424 | (1) |
|
|
425 | (2) |
|
|
427 | (14) |
|
Object-Oriented Programming |
|
|
427 | (5) |
|
|
428 | (2) |
|
|
430 | (2) |
|
Inheritance and Function Overriding |
|
|
432 | (1) |
|
Virtual vs. Nonvirtual Functions |
|
|
432 | (5) |
|
|
434 | (1) |
|
|
435 | (2) |
|
Creating and Destroying Objects |
|
|
437 | (1) |
|
|
438 | (1) |
|
|
439 | (2) |
|
|
441 | (12) |
|
|
442 | (1) |
|
Differences in x64 Architecture |
|
|
443 | (4) |
|
Differences in the x64 Calling Convention and Stack Usage |
|
|
444 | (3) |
|
64-Bit Exception Handling |
|
|
447 | (1) |
|
Windows 32-Bit on Windows 64-Bit |
|
|
447 | (1) |
|
64-Bit Hints at Malware Functionality |
|
|
448 | (1) |
|
|
449 | (1) |
|
|
450 | (3) |
|
A Important Windows Functions |
|
|
453 | (12) |
|
B Tools for Malware Analysis |
|
|
465 | (12) |
|
|
477 | (256) |
|
|
477 | (2) |
|
|
479 | (1) |
|
|
480 | (1) |
|
|
481 | (1) |
|
|
482 | (3) |
|
|
485 | (5) |
|
|
490 | (2) |
|
|
492 | (2) |
|
|
494 | (7) |
|
|
501 | (2) |
|
|
503 | (4) |
|
|
507 | (4) |
|
|
511 | (2) |
|
|
513 | (4) |
|
|
517 | (2) |
|
|
519 | (11) |
|
|
530 | (9) |
|
|
539 | (6) |
|
|
545 | (3) |
|
|
548 | (6) |
|
|
554 | (6) |
|
|
560 | (6) |
|
|
566 | (5) |
|
|
571 | (10) |
|
|
581 | (5) |
|
|
586 | (4) |
|
|
590 | (7) |
|
|
597 | (2) |
|
|
599 | (8) |
|
|
607 | (5) |
|
|
612 | (5) |
|
|
617 | (9) |
|
|
626 | (6) |
|
|
632 | (5) |
|
|
637 | (8) |
|
|
645 | (1) |
|
|
646 | (6) |
|
|
652 | (3) |
|
|
655 | (5) |
|
|
660 | (5) |
|
|
665 | (5) |
|
|
670 | (3) |
|
|
673 | (5) |
|
|
678 | (6) |
|
|
684 | (1) |
|
|
685 | (1) |
|
|
686 | (3) |
|
|
689 | (2) |
|
|
691 | (5) |
|
|
696 | (3) |
|
|
699 | (4) |
|
|
703 | (9) |
|
|
712 | (1) |
|
|
713 | (4) |
|
|
717 | (6) |
|
|
723 | (5) |
|
|
728 | (5) |
Index |
|
733 | |