book

Advanced Malware Analysis

Name: Advanced Malware Analysis
Author: Christopher Elisan
ISBN: 9780071819756

by Christopher Elisan

September 2015

Intermediate to advanced

464 pages

11h 26m

English

McGraw-Hill

Read now

Unlock full access

Cover
Title Page
Copyright Page
Dedication
Contents at a Glance
Contents
Foreword
Acknowledgments
Introduction
Part I Malware Blueprint

Chapter 1 Malware Analysis 101
Malware AnalysisMalware Analysis and Reverse EngineeringTypes of Malware AnalysisPurpose of Malware AnalysisLimitations of Malware AnalysisThe Malware Analysis ProcessThe Effective Malware AnalystFamiliarization with MalwareFamiliarization with Analysis ToolsPatienceRecap
Chapter 2 Malware Taxonomy
Malware ClassesInfectorsNetwork WormsTrojan HorseBackdoorsRemote-Access TrojanInformation StealersRansomwareScarewareFakewareGreywareRecap
Chapter 3 Malware Deployment
Malware Infection VectorsSpeedStealthCoverageShelf LifeTypes of Malware Infection VectorsPhysical MediaE-mailsInstant Messaging and ChatSocial NetworkingURL LinksFile SharesSoftware VulnerabilitiesPotential Infection VectorsRecap
Chapter 4 Protective Mechanisms
The Two States of MalwareStatic MalwareDynamic MalwareProtective MechanismsStatic Malware Protective MechanismsDynamic Malware Protective MechanismsRecap
Chapter 5 Malware Dependencies
Dependency TypesEnvironment DependenciesProgram DependenciesTiming DependenciesEvent DependenciesUser DependenciesFile DependenciesRecap
Part II Malware Research Lab
Chapter 6 Malware Collection
Your Own BackyardScan for Malicious FilesLook for Active RootkitsInspect Startup ProgramsInspect Running ProcessesExtract Suspicious FilesFree SourcesContagioKernelMode.infoMalShare.comMalware.luMalware BlacklistMalwarebytes ForumMalekal’s ForumOpen MalwareTuts4YouVirusShare.comVX HeavenMalware TrackersResearch Mailing ListsSample ExchangeCommercial SourcesHoneypotsDionaeaRecapTools
Chapter 7 Static Analysis Lab
The Static Analysis LabHost File Inspection ToolsMitigate Possible InfectionMitigate Becoming a Malware Staging PointAnonymous CommunicationSetting Up the LabChoose the HardwareInstall the Operating SystemHarden the LabAnonymize the LabIsolate the LabThe Virtualized Static Analysis LabBacking Up and RestoringRecapTools
Chapter 8 Dynamic Analysis Lab
Setting Up the LabChoose the HardwareInstall the Operating SystemMake the Lab Malware FriendlyAnonymize the LabIsolate the LabRestoring to a Clean StateVirtualized Environment Clean State RestorationBare-Metal Environment Clean State RestorationBacking Up and RestoringThe Golden ImageHost OSOther Systems Supporting the LabRecapTools
Part III Malware Inspection
Chapter 9 The Portable Executable File
The Windows Portable Executable FileThe PE File FormatRelative Virtual AddressPE Import FunctionsPE Export Functions64-Bit PE File FormatRecapTools
Chapter 10 The Proper Way to Handle Files
File’s Analysis Life CycleTransferAnalysisStorageRecapTools
Chapter 11 Inspecting Static Malware
Static Analysis TechniquesID AssignmentFile Type IdentificationAntivirus DetectionProtective Mechanisms IdentificationPE Structure VerificationStrings AnalysisRecapTools
Chapter 12 Inspecting Dynamic Malware
Virtual vs. Bare MetalDynamic AnalysisAnalyzing Host BehaviorAnalyzing Network BehaviorDynamic Analysis LimitationsRecapTools
Chapter 13 Tools of the Trade
Malware Analysis Use CasesMalware Analyst ToolboxTools of the TradeSysinternals SuiteYaraCygwinDebuggersDisassemblersMemory DumpersPE ViewersPE ReconstructorsMalcode Analyst PackRootkit ToolsNetwork Capturing ToolsAutomated SandboxesFree Online Automated Sandbox ServicesRecapTools
Part IV Appendixes
Appendix A Tools List
Appendix B List of Laboratories
Appendix C Volatility Framework Basic Plug-ins
Index

Content preview from Advanced Malware Analysis

Index

Please note that index links point to page beginnings from the print edition. Locations are approximate in e-readers, and you may need to page down one or more times after clicking a link to get to the indexed material.

Numbers

0x55AA setting, end-of-sector markers, 36–37

7zip, 272–274, 295

64-bit format, PE file, 267

A

access

hardening static analysis lab, 171–172

protecting transferred files, 271–272

user dependency attacks on, 101–105

active rootkits, detecting, 113–114

ActiveX control (OCS) files, implemented as DLLs, 234

ActiveX settings, Microsoft Office, 211

Adblock Plus add-on, Firefox, 171

ADD EAX/3, Immunity Debugger, 393, 396

ADD EAX/3/JMP EAX, Immunity Debugger, 394, 397

added files, monitoring file system for, 323–325

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9780071819756

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Advanced Malware Analysis

by Christopher Elisan