Learning Malware Analysis

1.4 Detecting Injected Code Using malfind

So far, we have looked at identifying suspicious memory regions manually using vadinfo. You have also understood how to dump a region of memory using vaddump. There is another Volatility plugin named malfind, which automates the process of identifying suspicious memory regions based on the memory content and the VAD characteristics covered previously. In the following example, when malfind was run against the memory image infected with SpyEye, it automatically identified the suspicious memory regions (containing a PE file and shellcode). In addition to that, it also displayed the hex dump and the disassembly starting at the base address. If you do not specify the -p (--pid) option, malfind will identify ...