Book Image

Mastering Malware Analysis

By : Alexey Kleymenov, Amr Thabet
Book Image

Mastering Malware Analysis

By: Alexey Kleymenov, Amr Thabet

Overview of this book

With the ever-growing proliferation of technology, the risk of encountering malicious code or malware has also increased. Malware analysis has become one of the most trending topics in businesses in recent years due to multiple prominent ransomware attacks. Mastering Malware Analysis explains the universal patterns behind different malicious software types and how to analyze them using a variety of approaches. You will learn how to examine malware code and determine the damage it can possibly cause to your systems to ensure that it won't propagate any further. Moving forward, you will cover all aspects of malware analysis for the Windows platform in detail. Next, you will get to grips with obfuscation and anti-disassembly, anti-debugging, as well as anti-virtual machine techniques. This book will help you deal with modern cross-platform malware. Throughout the course of this book, you will explore real-world examples of static and dynamic malware analysis, unpacking and decrypting, and rootkit detection. Finally, this book will help you strengthen your defenses and prevent malware breaches for IoT devices and mobile platforms. By the end of this book, you will have learned to effectively analyze, investigate, and build innovative solutions to handle any malware incidents.
Table of Contents (18 chapters)
Free Chapter
1
Section 1: Fundamental Theory
3
Section 2: Diving Deep into Windows Malware
5
Unpacking, Decryption, and Deobfuscation
9
Section 3: Examining Cross-Platform Malware
13
Section 4: Looking into IoT and Other Platforms

Radare2 cheat sheet

Many first-time users struggle with using radare2 because of an impressive number of commands that are supported. However, there is no need to use it as an analog for GDB. Radare2 features very convenient graphical interfaces that can be used in a similar way to IDA or other high-end commercial tools. In addition, multiple third-party UIs are available. To begin with, in order to enable debugging, the sample should be opened with the -d command-line argument, as in the following example:

r2 -d sample.bin

Here is a list of some of the most common commands supported (all commands are case-sensitive):

  • Generic commands: These commands can be used in the command-line interface and in visual mode (after entering the : key):
    • Collecting basic information: These include the following:
      • ?: Show the help. Detailed information about some particular command (and all commands with this prefix) can be obtained by entering it, followed by the ? sign, for example, dc?.
      • ?*~...: This...