Top Home-Based Job & Business Ideas for 2020: Best Places to Find Jobs to Work from Home Grouped by Interests & Hobbies from Basic to Expert Level (Influencer Fast Track® Series Book 4)

Practical Malware Analysis – книга для тех, кто хочет быть на шаг впереди последних вредоносных программ. Она дает практический анализ вредоносных программ и научит вас средствам и методам, используемым профессиональными аналитиками. С помощью этой книги, в качестве руководства, вы сможете безопасно анализировать и разбирать любые вредоносные программы, которые приходят на ваш сайт. Malware analysis is big business, and attacks can cost a company dearly. When malware breaches your defenses, you need to act quickly to cure current infections and prevent future ones from occurring. For those who want to stay ahead of the latest malware, Practical Malware Analysis will teach you the tools and techniques used by professional analysts. With this book as your guide, youll be able to safely analyze, debug, and disassemble any malicious software that comes your way. Youll learn how to: Set up a safe virtual environment to analyze malware Quickly extract network signatures and host-based indicators Use key analysis tools like IDA Pro, OllyDbg, and WinDbg Overcome malware tricks like obfuscation, anti-disassembly, anti-debugging, and anti-virtual machine techniques Use your newfound knowledge of Windows internals for malware analysis Develop a methodology for unpacking malware and get practical experience with five of the most popular packers Analyze special cases of malware with shellcode, C++, and 64-bit code Hands-on labs throughout the book challenge you to practice and synthesize your skills as you dissect real malware samples, and pages of detailed dissections offer an over-the-shoulder look at how the pros do it. Youll learn how to crack open malware to see how it really works, determine what damage it has done, thoroughly clean your network, and ensure that the malware never comes back. Malware analysis is a cat-and-mouse game with rules that are constantly changing, so make sure you have the fundamentals. Whether youre tasked with securing one network or a thousand networks, or youre making a living as a malware analyst, youll find what you need to succeed in Practical Malware Analysis. | Warning 3 About the Authors 20 About the Technical Reviewer 21 About the Contributing Authors 21 Foreword 22 Acknowledgments 26 Individual Thanks 26 Introduction 28 What Is Malware Analysis? 29 Prerequisites 29 Practical, Hands-On Learning 30 What’s in the Book? 31 0: Malware Analysis Primer 34 The Goals of Malware Analysis 34 Malware Analysis Techniques 35 Basic Static Analysis 35 Basic Dynamic Analysis 35 Advanced Static Analysis 36 Advanced Dynamic Analysis 36 Types of Malware 36 General Rules for Malware Analysis 38 Part 1: Basic Analysis 40 1: Basic Static Techniques 42 Antivirus Scanning: A Useful First Step 43 Hashing: A Fingerprint for Malware 43 Finding Strings 44 Packed and Obfuscated Malware 46 Packing Files 46 Detecting Packers with PEiD 47 Portable Executable File Format 47 Linked Libraries and Functions 48 Static, Runtime, and Dynamic Linking 48 Exploring Dynamically Linked Functions with Dependency Walker 49 Imported Functions 51 Exported Functions 51 Static Analysis in Practice 51 PotentialKeylogger.exe: An Unpacked Executable 51 PackedProgram.exe: A Dead End 54 The PE File Headers and Sections 54 Examining PE Files with PEview 55 Viewing the Resource Section with Resource Hacker 58 Using Other PE File Tools 59 PE Header Summary 59 Conclusion 59 Lab 1-1 60 Questions 60 Lab 1-2 60 Questions 61 Lab 1-3 61 Questions 61 Lab 1-4 61 Questions 61 2: Malware Analysis in Virtual Machines 62 The Structure of a Virtual Machine 63 Creating Your Malware Analysis Machine 64 Configuring VMware 64 Using Your Malware Analysis Machine 67 Connecting Malware to the Internet 67 Connecting and Disconnecting Peripheral Devices 67 Taking Snapshots 68 Transferring Files from a Virtual Machine 69 The Risks of Using VMware for Malware Analysis 69 Record/Replay: Running Your Computer in Reverse 70 Conclusion 70 3: Basic Dynamic Analysis 72 Sandboxes: The Quick-and-Dirty Approach 73 Using a Malware Sandbox 73 Sandbox Drawbacks 74 Running Malware 75 Monitoring with Process Monitor 76 The Procmon Display 77 Filtering in Procmon 77 Viewing Processes with Process Explorer 80 The Process Explorer Display 80 Using the Verify Option 81 Comparing Strings 82 Using Dependency Walker 82 Analyzing Malicious Documents 83 Comparing Registry Snapshots with Regshot 83 Faking a Network 84 Using ApateDNS 84 Monitoring with Netcat 85 Packet Sniffing with Wireshark 86 Using INetSim 88 Basic Dynamic Tools in Practice 89 Conclusion 93 Lab 3-1 94 Questions 94 Lab 3-2 94 Questions 94 Lab 3-3 94 Questions 94 Lab 3-4 95 Questions 95 Part 2: Advanced Static Analysis 96 4: A Crash Course in x86 Disassembly 98 Levels of Abstraction 99 Reverse-Engineering 100 The x86 Architecture 101 Main Memory 102 Instructions 102 Opcodes and Endianness 103 Operands 103 Registers 104 Simple Instructions 106 The Stack 110 Conditionals 113 Branching 113 Rep Instructions 114 C Main Method and Offsets 116 More Information: Intel x86 Architecture Manuals 118 Conclusion 118 5: IDA Pro 120 Loading an Executable 121 The IDA Pro Interface 122 Disassembly Window Modes 122 Useful Windows for Analysis 124 Returning to the Default View 125 Navigating IDA Pro 125 Searching 127 Using Cross-References 128 Code Cross-References 128 Data Cross-References 129 Analyzing Functions 130 Using Graphing Options 131 Enhancing Disassembly 133 Renaming Locations 133 Comments 133 Formatting Operands 133 Using Named Constants 135 Redefining Code and Data 136 Extending IDA with Plug-ins 136 Using IDC Scripts 137 Using IDAPython 138 Using Commercial Plug-ins 139 Conclusion 139 Lab 5-1 140 Questions 140 6: Recognizing C Code Constructs in Assembly 142 Global vs. Local Variables 143 Disassembling Arithmetic Operations 145 Recognizing if Statements 146 Analyzing Functions Graphically with IDA Pro 147 Recognizing Nested if Statements 147 Recognizing Loops 149 Finding for Loops 149 Finding while Loops 151 Understanding Function Call Conventions 152 cdecl 152 stdcall 153 fastcall 153 Push vs. Move 153 Analyzing switch Statements 154 If Style 155 Jump Table 156 Disassembling Arrays 160 Identifying Structs 161 Analyzing Linked List Traversal 163 Conclusion 165 Lab 6-1 166 Questions 166 Lab 6-2 166 Questions 166 Lab 6-3 166 Questions 167 Lab 6-4 167 Questions 167 7: Analyzing Malicious Windows Programs 168 The Windows API 169 Types and Hungarian Notation 169 Handles 170 File System Functions 170 Special Files 171 The Windows Registry 172 Registry Root Keys 173 Regedit 173 Programs that Run Automatically 173 Common Registry Functions 174 Analyzing Registry Code in Practice 174 Registry Scripting with .reg Files 175 Networking APIs 176 Berkeley Compatible Sockets 176 The Server and Client Sides of Networking 177 The WinINet API 178 Following Running Malware 178 DLLs 178 Processes 180 Threads 182 Interprocess Coordination with Mutexes 184 Services 185 The Component Object Model 187 Exceptions: When Things Go Wrong 190 Kernel vs. User Mode 191 The Native API 192 Conclusion 194 Lab 7-1 195 Questions 195 Lab 7-2 195 Questions 195 Lab 7-3 195 Questions 196 Part 3: Advanced Dynamic Analysis 198 8: Debugging 200 Source-Level vs. Assembly-Level Debuggers 201 Kernel vs. User-Mode Debugging 201 Using a Debugger 202 Single-Stepping 202 Stepping-Over vs. Stepping-Into 203 Pausing Execution with Breakpoints 204 Exceptions 208 First- and Second-Chance Exceptions 209 Common Exceptions 209 Modifying Execution with a Debugger 210 Modifying Program Execution in Practice 210 Conclusion 211 9: OllyDbg 212 Loading Malware 213 Opening an Executable 213 Attaching to a Running Process 214 The OllyDbg Interface 214 Memory Map 216 Rebasing 217 Viewing Threads and Stacks 218 Executing Code 219 Breakpoints 221 Software Breakpoints 221 Conditional Breakpoints 222 Hardware Breakpoints 223 Memory Breakpoints 223 Loading DLLs 224 Tracing 225 Standard Back Trace 225 Call Stack 226 Run Trace 226 Tracing Poison Ivy 226 Exception Handling 227 Patching 228 Analyzing Shellcode 229 Assistance Features 230 Plug-ins 230 OllyDump 231 Hide Debugger 231 Command Line 231 Bookmarks 232 Scriptable Debugging 233 Conclusion 234 Lab 9-1 235 Questions 235 Lab 9-2 235 Questions 235 Lab 9-3 236 Questions 236 10: Kernel Debugging with WinDbg 238 Drivers and Kernel Code 239 Setting Up Kernel Debugging 240 Using WinDbg 243 Reading from Memory 243 Using Arithmetic Operators 244 Setting Breakpoints 244 Listing Modules 245 Microsoft Symbols 245 Searching for Symbols 245 Viewing Structure Information 246 Configuring Windows Symbols 248 Kernel Debugging in Practice 248 Looking at the User-Space Code 248 Looking at the Kernel-Mode Code 250 Finding Driver Objects 253 Rootkits 254 Rootkit Analysis in Practice 255 Interrupts 258 Loading Drivers 259 Kernel Issues for Windows Vista, Windows 7, and x64 Versions 259 Conclusion 260 Lab 10-1 261 Questions 261 Lab 10-2 261 Questions 261 Lab 10-3 261 Questions 261 Part 4: Malware Functionality 262 11: Malware Behavior 264 Downloaders and Launchers 264 Backdoors 265 Reverse Shell 265 RATs 266 Botnets 267 RATs and Botnets Compared 267 Credential Stealers 267 GINA Interception 268 Hash Dumping 269 Keystroke Logging 271 Persistence Mechanisms 274 The Windows Registry 274 Trojanized System Binaries 276 DLL Load-Order Hijacking 277 Privilege Escalation 278 Using SeDebugPrivilege 279 Covering Its Tracks—User-Mode Rootkits 280 IAT Hooking 281 Inline Hooking 281 Conclusion 283 Lab 11-1 284 Questions 284 Lab 11-2 284 Questions 284 Lab 11-3 284 Questions 285 12: Covert Malware Launching 286 Launchers 286 Process Injection 287 DLL Injection 287 Direct Injection 290 Process Replacement 290 Hook Injection 292 Local and Remote Hooks 293 Keyloggers Using Hooks 293 Using SetWindowsHookEx 293 Thread Targeting 294 Detours 295 APC Injection 295 APC Injection from User Space 296 APC Injection from Kernel Space 297 Conclusion 298 Lab 12-1 299 Questions 299 Lab 12-2 299 Questions 299 Lab 12-3 299 Questions 299 Lab 12-4 299 Questions 300 13: Data Encoding 302 The Goal of Analyzing Encoding Algorithms 303 Simple Ciphers 303 Caesar Cipher 303 XOR 304 Other Simple Encoding Schemes 309 Base64 310 Common Cryptographic Algorithms 313 Recognizing Strings and Imports 314 Searching for Cryptographic Constants 315 Searching for High-Entropy Content 316 Custom Encoding 318 Identifying Custom Encoding 318 Advantages of Custom Encoding to the Attacker 321 Decoding 321 Self-Decoding 321 Manual Programming of Decoding Functions 322 Using Instrumentation for Generic Decryption 324 Conclusion 327 Lab 13-1 328 Questions 328 Lab 13-2 328 Questions 328 Lab 13-3 329 Questions 329 14: Malware-Focused Network Signatures 330 Network Countermeasures 330 Observing the Malware in Its Natural Habitat 331 Indications of Malicious Activity 331 OPSEC = Operations Security 332 Safely Investigate an Attacker Online 333 Indirection Tactics 333 Getting IP Address and Domain Information 333 Content-Based Network Countermeasures 335 Intrusion Detection with Snort 336 Taking a Deeper Look 337 Combining Dynamic and Static Analysis Techniques 340 The Danger of Overanalysis 341 Hiding in Plain Sight 341 Understanding Surrounding Code 345 Finding the Networking Code 346 Knowing the Sources of Network Content 347 Hard-Coded Data vs. Ephemeral Data 347 Identifying and Leveraging the Encoding Steps 348 Creating a Signature 350 Analyze the Parsing Routines 351 Targeting Multiple Elements 353 Understanding the Attacker’s Perspective 354 Conclusion 355 Lab 14-1 356 Questions 356 Lab 14-2 356 Questions 356 Lab 14-3 357 Questions 357 Part 5: Anti-Reverse-Engineering 358 15: Anti-Disassembly 360 Understanding Anti-Disassembly 361 Defeating Disassembly Algorithms 362 Linear Disassembly 362 Flow-Oriented Disassembly 364 Anti-Disassembly Techniques 367 Jump Instructions with the Same Target 367 A Jump Instruction with a Constant Condition 369 Impossible Disassembly 370 NOP-ing Out Instructions with IDA Pro 373 Obscuring Flow Control 373 The Function Pointer Problem 373 Adding Missing Code Cross-References in IDA Pro 375 Return Pointer Abuse 375 Misusing Structured Exception Handlers 377 Thwarting Stack-Frame Analysis 380 Conclusion 382 Lab 15-1 383 Questions 383 Lab 15-2 383 Questions 383 Lab 15-3 383 Questions 383 16: Anti-Debugging 384 Windows Debugger Detection 385 Using the Windows API 385 Manually Checking Structures 386 Checking for System Residue 389 Identifying Debugger Behavior 389 INT Scanning 390 Performing Code Checksums 390 Timing Checks 390 Interfering with Debugger Functionality 392 Using TLS Callbacks 392 Using Exceptions 394 Inserting Interrupts 395 Debugger Vulnerabilities 396 PE Header Vulnerabilities 396 The OutputDebugString Vulnerability 398 Conclusion 398 Lab 16-1 400 Questions 400 Lab 16-2 400 Questions 400 Lab 16-3 401 Questions 401 17: Anti-Virtual Machine Techniques 402 VMware Artifacts 403 Bypassing VMware Artifact Searching 405 Checking for Memory Artifacts 406 Vulnerable Instructions 406 Using the Red Pill Anti-VM Technique 407 Using the No Pill Technique 408 Querying the I/O Communication Port 408 Using the str Instruction 410 Anti-VM x86 Instructions 410 Highlighting Anti-VM in IDA Pro 410 Using ScoopyNG 412 Tweaking Settings 412 Escaping the Virtual Machine 413 Conclusion 413 Lab 17-1 414 Questions 414 Lab 17-2 414 Questions 414 Lab 17-3 415 Questions 415 18: Packers and Unpacking 416 Packer Anatomy 417 The Unpacking Stub 417 Loading the Executable 417 Resolving Imports 418 The Tail Jump 419 Unpacking Illustrated 419 Identifying Packed Programs 420 Indicators of a Packed Program 420 Entropy Calculation 420 Unpacking Options 421 Automated Unpacking 421 Manual Unpacking 422 Rebuilding the Import Table with Import Reconstructor 423 Finding the OEP 424 Repairing the Import Table Manually 428 Tips and Tricks for Common Packers 430 UPX 430 PECompact 430 ASPack 431 Petite 431 WinUpack 431 Themida 433 Analyzing Without Fully Unpacking 433 Packed DLLs 434 Conclusion 435 Labs 436 Part 6: Special Topics 438 19: Shellcode Analysis 440 Loading Shellcode for Analysis 441 Position-Independent Code 441 Identifying Execution Location 442 Using call/pop 442 Using fnstenv 444 Manual Symbol Resolution 446 Finding kernel32.dll in Memory 446 Parsing PE Export Data 448 Using Hashed Exported Names 450 A Full Hello World Example 451 Shellcode Encodings 454 NOP Sleds 455 Finding Shellcode 456 Conclusion 457 Lab 19-1 458 Questions 458 Lab 19-2 458 Questions 458 Lab 19-3 458 Questions 459 20: C++ Analysis 460 Object-Oriented Programming 460 The this Pointer 461 Overloading and Mangling 463 Inheritance and Function Overriding 465 Virtual vs. Nonvirtual Functions 465 Use of Vtables 467 Recognizing a Vtable 468 Creating and Destroying Objects 470 Conclusion 471 Lab 20-1 472 Questions 472 Lab 20-2 472 Questions 472 Lab 20-3 472 Questions 473 21: 64-Bit Malware 474 Why 64-Bit Malware? 475 Differences in x64 Architecture 476 Differences in the x64 Calling Convention and Stack Usage 477 64-Bit Exception Handling 480 Windows 32-Bit on Windows 64-Bit 480 64-Bit Hints at Malware Functionality 481 Conclusion 482 Lab 21-1 483 Questions 483 Lab 21-2 483 Questions 483 A: Important Windows Functions 486 B: Tools for Malware Analysis 498 C: Solutions to Labs 510 Chapter 1 510 Lab 1-1 Solutions 510 Short Answers 510 Detailed Analysis 511 Lab 1-2 Solutions 512 Short Answers 512 Detailed Analysis 512 Lab 1-3 Solutions 513 Short Answers 513 Detailed Analysis 513 Lab 1-4 Solutions 514 Short Answers 514 Detailed Analysis 514 Chapter 3 515 Lab 3-1 Solutions 515 Short Answers 515 Detailed Analysis 515 Lab 3-2 Solutions 518 Short Answers 518 Detailed Analysis 519 Lab 3-3 Solutions 523 Short Answers 523 Detailed Analysis 523 Lab 3-4 Solutions 525 Short Answers 525 Detailed Analysis 525 Chapter 5 527 Lab 5-1 Solutions 527 Short Answers 527 Detailed Analysis 528 Chapter 6 534 Lab 6-1 Solutions 534 Short Answers 534 Detailed Analysis 534 Lab 6-2 Solutions 536 Short Answers 536 Detailed Analysis 536 Lab 6-3 Solutions 540 Short Answers 540 Detailed Analysis 541 Lab 6-4 Solutions 544 Short Answers 544 Detailed Analysis 544 Chapter 7 546 Lab 7-1 Solutions 546 Short Answers 546 Detailed Analysis 546 Lab 7-2 Solutions 550 Short Answers 550 Detailed Analysis 550 Lab 7-3 Solutions 552 Short Answers 552 Detailed Analysis 553 Chapter 9 563 Lab 9-1 Solutions 563 Short Answers 563 Detailed Analysis 563 Lab 9-2 Solutions 572 Short Answers 572 Detailed Analysis 573 Lab 9-3 Solutions 578 Short Answers 578 Detailed Analysis 578 Chapter 10 581 Lab 10-1 Solutions 581 Short Answers 581 Detailed Analysis 582 Lab 10-2 Solutions 587 Short Answers 587 Detailed Analysis 587 Lab 10-3 Solutions 593 Short Answers 593 Detailed Analysis 593 Chapter 11 599 Lab 11-1 Solutions 599 Short Answers 599 Detailed Analysis 600 Lab 11-2 Solutions 604 Short Answers 604 Detailed Analysis 604 Lab 11-3 Solutions 614 Short Answers 614 Detailed Analysis 614 Chapter 12 619 Lab 12-1 Solutions 619 Short Answers 619 Detailed Analysis 619 Lab 12-2 Solutions 623 Short Answers 623 Detailed Analysis 623 Lab 12-3 Solutions 630 Short Answers 630 Detailed Analysis 630 Lab 12-4 Solutions 632 Short Answers 632 Detailed Analysis 633 Chapter 13 640 Lab 13-1 Solutions 640 Short Answers 640 Detailed Analysis 640 Lab 13-2 Solutions 645 Short Answers 645 Detailed Analysis 645 Lab 13-3 Solutions 650 Short Answers 650 Detailed Analysis 651 Chapter 14 659 Lab 14-1 Solutions 659 Short Answers 659 Detailed Analysis 660 Lab 14-2 Solutions 665 Short Answers 665 Detailed Analysis 666 Lab 14-3 Solutions 670 Short Answers 670 Detailed Analysis 672 Chapter 15 678 Lab 15-1 Solutions 678 Short Answers 678 Detailed Analysis 678 Lab 15-2 Solutions 679 Short Answers 679 Detailed Analysis 680 Lab 15-3 Solutions 685 Short Answers 685 Detailed Analysis 685 Chapter 16 688 Lab 16-1 Solutions 688 Short Answers 688 Detailed Analysis 689 Lab 16-2 Solutions 693 Short Answers 693 Detailed Analysis 694 Lab 16-3 Solutions 698 Short Answers 698 Detailed Analysis 698 Chapter 17 703 Lab 17-1 Solutions 703 Short Answers 703 Detailed Analysis 703 Lab 17-2 Solutions 706 Short Answers 706 Detailed Analysis 706 Lab 17-3 Solutions 711 Short Answers 711 Detailed Analysis 711 Chapter 18 717 Lab 18-1 Solutions 717 Lab 18-2 Solutions 718 Lab 18-3 Solutions 719 Lab 18-4 Solutions 722 Lab 18-5 Solutions 724 Chapter 19 729 Lab 19-1 Solutions 729 Short Answers 729 Detailed Analysis 729 Lab 19-2 Solutions 732 Short Answers 732 Detailed Analysis 732 Lab 19-3 Solutions 736 Short Answers 736 Detailed Analysis 737 Chapter 20 745 Lab 20-1 Solutions 745 Short Answers 745 Detailed Analysis 745 Lab 20-2 Solutions 746 Short Answers 746 Detailed Analysis 747 Lab 20-3 Solutions 750 Short Answers 750 Detailed Analysis 750 Chapter 21 756 Lab 21-1 Solutions 756 Short Answers 756 Detailed Analysis 757 Lab 21-2 Solutions 761 Short Answers 761 Detailed Analysis 762 Index 766 www.it-ebooks.info IT eBooks There are more than 100 malicious computer attacks every second, resulting in tens of billions of dollars in economic damages each year. Among security professionals, the skills required to quickly analyze and assess these attacks are in high demand. Practical Malware Analysis provides a rapid introduction to the tools and methods used to dissect malicious software (malware), showing readers how to discover, debug, and disassemble these threats. The book goes on to examine how to overcome the evasive techniques?stealth, code obfuscation, encryption, file packing, and others?that malware author