book

Advanced Malware Analysis

Name: Advanced Malware Analysis
Author: Christopher Elisan
ISBN: 9780071819756

by Christopher Elisan

September 2015

Intermediate to advanced

464 pages

11h 26m

English

McGraw-Hill

Read now

Unlock full access

Cover
Title Page
Copyright Page
Dedication
Contents at a Glance
Contents
Foreword
Acknowledgments
Introduction
Part I Malware Blueprint

Chapter 1 Malware Analysis 101
Malware AnalysisMalware Analysis and Reverse EngineeringTypes of Malware AnalysisPurpose of Malware AnalysisLimitations of Malware AnalysisThe Malware Analysis ProcessThe Effective Malware AnalystFamiliarization with MalwareFamiliarization with Analysis ToolsPatienceRecap
Chapter 2 Malware Taxonomy
Malware ClassesInfectorsNetwork WormsTrojan HorseBackdoorsRemote-Access TrojanInformation StealersRansomwareScarewareFakewareGreywareRecap
Chapter 3 Malware Deployment
Malware Infection VectorsSpeedStealthCoverageShelf LifeTypes of Malware Infection VectorsPhysical MediaE-mailsInstant Messaging and ChatSocial NetworkingURL LinksFile SharesSoftware VulnerabilitiesPotential Infection VectorsRecap
Chapter 4 Protective Mechanisms
The Two States of MalwareStatic MalwareDynamic MalwareProtective MechanismsStatic Malware Protective MechanismsDynamic Malware Protective MechanismsRecap
Chapter 5 Malware Dependencies
Dependency TypesEnvironment DependenciesProgram DependenciesTiming DependenciesEvent DependenciesUser DependenciesFile DependenciesRecap
Part II Malware Research Lab
Chapter 6 Malware Collection
Your Own BackyardScan for Malicious FilesLook for Active RootkitsInspect Startup ProgramsInspect Running ProcessesExtract Suspicious FilesFree SourcesContagioKernelMode.infoMalShare.comMalware.luMalware BlacklistMalwarebytes ForumMalekal’s ForumOpen MalwareTuts4YouVirusShare.comVX HeavenMalware TrackersResearch Mailing ListsSample ExchangeCommercial SourcesHoneypotsDionaeaRecapTools
Chapter 7 Static Analysis Lab
The Static Analysis LabHost File Inspection ToolsMitigate Possible InfectionMitigate Becoming a Malware Staging PointAnonymous CommunicationSetting Up the LabChoose the HardwareInstall the Operating SystemHarden the LabAnonymize the LabIsolate the LabThe Virtualized Static Analysis LabBacking Up and RestoringRecapTools
Chapter 8 Dynamic Analysis Lab
Setting Up the LabChoose the HardwareInstall the Operating SystemMake the Lab Malware FriendlyAnonymize the LabIsolate the LabRestoring to a Clean StateVirtualized Environment Clean State RestorationBare-Metal Environment Clean State RestorationBacking Up and RestoringThe Golden ImageHost OSOther Systems Supporting the LabRecapTools
Part III Malware Inspection
Chapter 9 The Portable Executable File
The Windows Portable Executable FileThe PE File FormatRelative Virtual AddressPE Import FunctionsPE Export Functions64-Bit PE File FormatRecapTools
Chapter 10 The Proper Way to Handle Files
File’s Analysis Life CycleTransferAnalysisStorageRecapTools
Chapter 11 Inspecting Static Malware
Static Analysis TechniquesID AssignmentFile Type IdentificationAntivirus DetectionProtective Mechanisms IdentificationPE Structure VerificationStrings AnalysisRecapTools
Chapter 12 Inspecting Dynamic Malware
Virtual vs. Bare MetalDynamic AnalysisAnalyzing Host BehaviorAnalyzing Network BehaviorDynamic Analysis LimitationsRecapTools
Chapter 13 Tools of the Trade
Malware Analysis Use CasesMalware Analyst ToolboxTools of the TradeSysinternals SuiteYaraCygwinDebuggersDisassemblersMemory DumpersPE ViewersPE ReconstructorsMalcode Analyst PackRootkit ToolsNetwork Capturing ToolsAutomated SandboxesFree Online Automated Sandbox ServicesRecapTools
Part IV Appendixes
Appendix A Tools List
Appendix B List of Laboratories
Appendix C Volatility Framework Basic Plug-ins
Index

Content preview from Advanced Malware Analysis

CHAPTER9

The Portable Executable File

Malware inspection is where the excitement begins. This is the process where you actually dissect the malware sample and find out what it is capable of doing. But as with any inspection or analysis exercise, a process has to be followed to get the most out of the activity. And in a malware inspection activity (more popularly known as a malware analysis activity), there are steps that needed to be followed to effectively analyze malware.

Going back to the malware analysis process discussed in Chapter 1, the malware goes through multiple steps of analysis to get to the bottom of its malicious directive, as shown in Figure 9-1.

Figure 9-1 The malware analysis process.

But before analysis should begin, ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9780071819756

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Advanced Malware Analysis

by Christopher Elisan

CHAPTER9

The Portable Executable File

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.