The constant arms race between malware authors and defenders has significantly raised the bar for both sides in terms of sophistication. One of the results of the above is that the bulk of modern malware comes in an obfuscated and packed form, armoured with several anti-analysis features. This is to prevent, or at least delay, their analysis, extraction of generic signatures, or even understanding of their capabilities. Thus, simply relying on automated processes and static analysis is not enough. The malware analyst must be able to remove such protection layers from a binary under investigation and examine the core functionality of the malware. This requires a lot of low-level manual effort. To this end, the goal of this chapter is to serve as a guide for potential analysts into how they can manually analyse a malicious sample, protected by a packer, and dump the malicious family payload locally for further research using as baseline a real-world malware.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Unpacking Malware in the Real World: A Step-by Step Guide

  • Nikolaos Totosis,
  • Constantinos Patsakis

摘要

The constant arms race between malware authors and defenders has significantly raised the bar for both sides in terms of sophistication. One of the results of the above is that the bulk of modern malware comes in an obfuscated and packed form, armoured with several anti-analysis features. This is to prevent, or at least delay, their analysis, extraction of generic signatures, or even understanding of their capabilities. Thus, simply relying on automated processes and static analysis is not enough. The malware analyst must be able to remove such protection layers from a binary under investigation and examine the core functionality of the malware. This requires a lot of low-level manual effort. To this end, the goal of this chapter is to serve as a guide for potential analysts into how they can manually analyse a malicious sample, protected by a packer, and dump the malicious family payload locally for further research using as baseline a real-world malware.