Payload Placement (PE files)
2024-08-07
Malware developers have options as to where they place the payload for their malware within a PE file. The .data and .rdata sections are easy and ...
Read More
Persistence
2024-08-06
Persistence in the context of malware refers to the ability of malicious code to survive after the exploited component is terminated or the system is ...
Read More
Process Injection
2024-08-06
Process Injection is a method of executing arbitrary code into the address space of a separate running process.
Process Injection can be carried out ...
Read More
anti-analysis
2024-08-05
Malware may implement features to make analysis and reverse engineering more difficult. These are known as anti-analysis or anti-reversing techniques.
Read More
antivirus
2024-08-05
Antivirus software (AV) or anti-malware are computer programs used to prevent, detect, and remove malware.
Read More
Behavior-based Detection
2024-08-05
Once malware is running, security software will continue to look for suspicious behavior emitted by running processes.
For example, if a notepad.exe ...
Read More
CreateFile
2024-08-05
CreateFile() is a WinAPI macro (chooses CreateFileA or CreateFileW as appropriate) that creates a new file or opens an existing file. On success, a ...
Read More
Dynamic Link Library
2024-08-05 pe windows
A dynamic-link library (DLL) is a shared library in the Microsoft Windows operating system. This is similar to Shared Object (.so files) on *nix ...
Read More
Handle
2024-08-05
A handle is an abstract reference value to a resource, often memory or an open file, named pipe, socket, etc.
These are similar to file descriptors ...
Read More
Hashing Detection
2024-08-05
Hashing detections are done by saving file hashes of known to be malicious files and comparing them with samples to be analyzed. If the file hashes ...
Read More