Windows Malware Analysis Essentials

Chapter 3. Performing a Séance Session

Apprehending malware red-handed is a very exhilarating feeling for an analyst. Debugging technology provides a wealth of information about a malware's inner construction and layout, and, most importantly, its modus operandi. You can take the metaphor of an ultra-high-speed camera used to capture a slow motion video of a moving bullet that plots its trajectory as a projectile, which hits its intended target and the effects thereof, and compare that with a debugger used to capture the execution trace of a malware instruction by instruction. Things are seldom that simply extrapolated, and hence you could also compare an analysis session as a criminal interrogation (analyst/debugger/target sample) in a Spook ...