book

Advanced Malware Analysis

Name: Advanced Malware Analysis
Author: Christopher Elisan
ISBN: 9780071819756

by Christopher Elisan

September 2015

Intermediate to advanced

464 pages

11h 26m

English

McGraw-Hill

Read now

Unlock full access

Cover
Title Page
Copyright Page
Dedication
Contents at a Glance
Contents
Foreword
Acknowledgments
Introduction
Part I Malware Blueprint

Chapter 1 Malware Analysis 101
Malware AnalysisMalware Analysis and Reverse EngineeringTypes of Malware AnalysisPurpose of Malware AnalysisLimitations of Malware AnalysisThe Malware Analysis ProcessThe Effective Malware AnalystFamiliarization with MalwareFamiliarization with Analysis ToolsPatienceRecap
Chapter 2 Malware Taxonomy
Malware ClassesInfectorsNetwork WormsTrojan HorseBackdoorsRemote-Access TrojanInformation StealersRansomwareScarewareFakewareGreywareRecap
Chapter 3 Malware Deployment
Malware Infection VectorsSpeedStealthCoverageShelf LifeTypes of Malware Infection VectorsPhysical MediaE-mailsInstant Messaging and ChatSocial NetworkingURL LinksFile SharesSoftware VulnerabilitiesPotential Infection VectorsRecap
Chapter 4 Protective Mechanisms
The Two States of MalwareStatic MalwareDynamic MalwareProtective MechanismsStatic Malware Protective MechanismsDynamic Malware Protective MechanismsRecap
Chapter 5 Malware Dependencies
Dependency TypesEnvironment DependenciesProgram DependenciesTiming DependenciesEvent DependenciesUser DependenciesFile DependenciesRecap
Part II Malware Research Lab
Chapter 6 Malware Collection
Your Own BackyardScan for Malicious FilesLook for Active RootkitsInspect Startup ProgramsInspect Running ProcessesExtract Suspicious FilesFree SourcesContagioKernelMode.infoMalShare.comMalware.luMalware BlacklistMalwarebytes ForumMalekal’s ForumOpen MalwareTuts4YouVirusShare.comVX HeavenMalware TrackersResearch Mailing ListsSample ExchangeCommercial SourcesHoneypotsDionaeaRecapTools
Chapter 7 Static Analysis Lab
The Static Analysis LabHost File Inspection ToolsMitigate Possible InfectionMitigate Becoming a Malware Staging PointAnonymous CommunicationSetting Up the LabChoose the HardwareInstall the Operating SystemHarden the LabAnonymize the LabIsolate the LabThe Virtualized Static Analysis LabBacking Up and RestoringRecapTools
Chapter 8 Dynamic Analysis Lab
Setting Up the LabChoose the HardwareInstall the Operating SystemMake the Lab Malware FriendlyAnonymize the LabIsolate the LabRestoring to a Clean StateVirtualized Environment Clean State RestorationBare-Metal Environment Clean State RestorationBacking Up and RestoringThe Golden ImageHost OSOther Systems Supporting the LabRecapTools
Part III Malware Inspection
Chapter 9 The Portable Executable File
The Windows Portable Executable FileThe PE File FormatRelative Virtual AddressPE Import FunctionsPE Export Functions64-Bit PE File FormatRecapTools
Chapter 10 The Proper Way to Handle Files
File’s Analysis Life CycleTransferAnalysisStorageRecapTools
Chapter 11 Inspecting Static Malware
Static Analysis TechniquesID AssignmentFile Type IdentificationAntivirus DetectionProtective Mechanisms IdentificationPE Structure VerificationStrings AnalysisRecapTools
Chapter 12 Inspecting Dynamic Malware
Virtual vs. Bare MetalDynamic AnalysisAnalyzing Host BehaviorAnalyzing Network BehaviorDynamic Analysis LimitationsRecapTools
Chapter 13 Tools of the Trade
Malware Analysis Use CasesMalware Analyst ToolboxTools of the TradeSysinternals SuiteYaraCygwinDebuggersDisassemblersMemory DumpersPE ViewersPE ReconstructorsMalcode Analyst PackRootkit ToolsNetwork Capturing ToolsAutomated SandboxesFree Online Automated Sandbox ServicesRecapTools
Part IV Appendixes
Appendix A Tools List
Appendix B List of Laboratories
Appendix C Volatility Framework Basic Plug-ins
Index

Overview

A one-of-a-kind guide to setting up a malware research lab, using cutting-edge analysis tools, and reporting the findings

Advanced Malware Analysis is a critical resource for every information security professional's anti-malware arsenal. The proven troubleshooting techniques will give an edge to information security professionals whose job involves detecting, decoding, and reporting on malware.

After explaining malware architecture and how it operates, the book describes how to create and configure a state-of-the-art malware research lab and gather samples for analysis. Then, you’ll learn how to use dozens of malware analysis tools, organize data, and create metrics-rich reports.

A crucial tool for combatting malware—which currently hits each second globally
Filled with undocumented methods for customizing dozens of analysis software tools for very specific uses
Leads you through a malware blueprint first, then lab setup, and finally analysis and reporting activities
Every tool explained in this book is available in every country around the world

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9780071819756

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills