Practical Malware Analysis

Hook Injection

Hook injection describes a way to load malware that takes advantage of Windows hooks, which are used to intercept messages destined for applications. Malware authors can use hook injection to accomplish two things:

• To be sure that malicious code will run whenever a particular message is intercepted

• To be sure that a particular DLL will be loaded in a victim process’s memory space

As shown in Figure 12-3, users generate events that are sent to the OS, which then sends messages created by those events to threads registered to receive them. The right side of the figure shows one way that an attacker can insert a malicious DLL to intercept messages.

Figure 12-3. Event and message flow in Windows with and without hook injection

Local and ...