full-disclosure - Malicious Code Analysis

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200508051004.j75A4Dia020166@mailserver2.hushmail.com>
Date: Fri Aug  5 11:04:27 2005
From: ngiles at hushmail.com (mike king)
Subject: Malicious Code Analysis

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thanks for all the feedback. I have always taken the poor mans
approach to this since its not really my job, but a fun hobby on
the side.

regards mike

On Fri, 05 Aug 2005 02:49:49 -0700 Peter Kruse <pkr@...s.dk> wrote:
>Hey,
>
>> These were not submitted to any AV vendors since Norton did
>> flag them. In the past I have submitted unknown trojans/
>> viruses like these to Symantec when clients have been owned,
>> but what can I say they are hardly 0day more like 300 day.
>
>8-)
>
>> http://www.bitsum.com/pec2.asp
>
>Yes, I already have this tool in my box. Pretty useful for first
>glance.
>
>> Could you share your methodology on how you go about reverse
>> engineering/ disassembling a malicious piece of code that has
>> had a packer ran on it?
>
>There are many off-the self unpackers out there that will do the
>job just
>fine, but lately malware writters rather modify or use
>enhanced/hacked
>version of popular PE-packers. Either way a compressed binary will

>have to
>uncompress itself using the compressor stub in order to run. In
>order to
>unpack look for the call that jumps from the stub to unpacked
>code. When the
>jmp address is located modify so the jmp goes to esi. This will
>put the code
>in a loop. Next procdump.
>
>There are plenty of good tutorials. One of these are associated
>with IDA:
>http://www.datarescue.com/idabase/unpack_pe/
>
>I hope this helps you getting started.
>
>Regards
>Peter Kruse
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkLzNy8ACgkQUjm7xSZSd8GYjACeIoBxJOXEqi4omXslFRpJRGF7Vw0A
n3tB9zvUITpeklmYRUG0GQN8Gxjs
=rUI8
-----END PGP SIGNATURE-----