The following screenshot demonstrates sections, which are numbered from 1 to 4. These sections are key to understanding and identifying the encryption algorithms that are used in malware:
To identify an encryption function, there are four things you should be searching for, as shown in the following table:
|
1 |
Sequential data read |
The encryption function has to read data from memory—not a fixed value, but an array of bytes, one by one. |
|
2 |
Encrypting the value |
There's no encryption loop without encryption! It may sound obvious, but a loop with sequential read and sequential write can be easily misunderstood as an encryption loop, and they are just data or memory copiers. |
|
3 |
Sequential data write |
A sequential data write is also easy to miss. If the function is writing by a fixed address, it's possible that it is just generating a checksum... |