Contents

Search in book...
Toggle Font Controls
Create new playlist

Name your new playlist

Playlist description (optional)
Sign In

Email address

Password

Forgot Password?

or

Continue with Facebook

Continue with Google
Sign Up

Full Name

Email address

Confirm Email Address

Password

or

Continue with Facebook

Continue with Google

Previous Chapter

Contents at a Glance

Contents

Acknowledgments

Introduction

Part I Malware Blueprint

Chapter 1 Malware Analysis 101

Malware Analysis

Malware Analysis and Reverse Engineering

Types of Malware Analysis

Purpose of Malware Analysis

Limitations of Malware Analysis

The Malware Analysis Process

The Effective Malware Analyst

Familiarization with Malware

Familiarization with Analysis Tools

Chapter 2 Malware Taxonomy

Malware Classes

Remote-Access Trojan

Information Stealers

Chapter 3 Malware Deployment

Malware Infection Vectors

Types of Malware Infection Vectors

Instant Messaging and Chat

Social Networking

Software Vulnerabilities

Potential Infection Vectors

Chapter 4 Protective Mechanisms

The Two States of Malware

Dynamic Malware

Protective Mechanisms

Static Malware Protective Mechanisms

Dynamic Malware Protective Mechanisms

Chapter 5 Malware Dependencies

Dependency Types

Environment Dependencies

Program Dependencies

Timing Dependencies

Event Dependencies

User Dependencies

File Dependencies

Part II Malware Research Lab

Chapter 6 Malware Collection

Your Own Backyard

Scan for Malicious Files

Look for Active Rootkits

Inspect Startup Programs

Inspect Running Processes

Extract Suspicious Files

KernelMode.info

Malware Blacklist

Malwarebytes Forum

Malekal’s Forum

Malware Trackers

Research Mailing Lists

Sample Exchange

Commercial Sources

Chapter 7 Static Analysis Lab

The Static Analysis Lab

Host File Inspection Tools

Mitigate Possible Infection

Mitigate Becoming a Malware Staging Point

Anonymous Communication

Setting Up the Lab

Choose the Hardware

Install the Operating System

Anonymize the Lab

Isolate the Lab

The Virtualized Static Analysis Lab

Backing Up and Restoring

Chapter 8 Dynamic Analysis Lab

Setting Up the Lab

Choose the Hardware

Install the Operating System

Make the Lab Malware Friendly

Anonymize the Lab

Isolate the Lab

Restoring to a Clean State

Virtualized Environment Clean State Restoration

Bare-Metal Environment Clean State Restoration

Backing Up and Restoring

The Golden Image

Other Systems Supporting the Lab

Part III Malware Inspection

Chapter 9 The Portable Executable File

The Windows Portable Executable File

The PE File Format

Relative Virtual Address

PE Import Functions

PE Export Functions

64-Bit PE File Format

Chapter 10 The Proper Way to Handle Files

File’s Analysis Life Cycle

Chapter 11 Inspecting Static Malware

Static Analysis Techniques

File Type Identification

Antivirus Detection

Protective Mechanisms Identification

PE Structure Verification

Strings Analysis

Chapter 12 Inspecting Dynamic Malware

Virtual vs. Bare Metal

Dynamic Analysis

Analyzing Host Behavior

Analyzing Network Behavior

Dynamic Analysis Limitations

Chapter 13 Tools of the Trade

Malware Analysis Use Cases

Malware Analyst Toolbox

Tools of the Trade

Sysinternals Suite

PE Reconstructors

Malcode Analyst Pack

Network Capturing Tools

Automated Sandboxes

Free Online Automated Sandbox Services

Part IV Appendixes

Appendix A Tools List

Appendix B List of Laboratories

Appendix C Volatility Framework Basic Plug-ins

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.

18.191.171.235