packtpublishing / malware-analysis-techniques Goto Github PK

View Code? Open in Web Editor NEW

59.0 10.0 19.0 6.68 MB

Malware Analysis Techniques, published by Packt

License: MIT License

malware-analysis-techniques's Introduction

Malware Analysis Techniques

This is the code repository for Malware Analysis Techniques, published by Packt.

Tricks for the triage of adversarial software

What is this book about?

Malicious software poses a threat to every enterprise globally. Its growth is costing businesses millions of dollars due to currency theft as a result of ransomware and lost productivity. With this book, you'll learn how to quickly triage, identify, attribute, and remediate threats using proven analysis techniques.

This book covers the following exciting features:

Discover how to maintain a safe analysis environment for malware samples
Get to grips with static and dynamic analysis techniques for collecting IOCs
Reverse-engineer and debug malware to understand its purpose
Develop a well-polished workflow for malware analysis
Understand when and where to implement automation to react quickly to threats

If you feel this book is for you, get your copy today!

Instructions and Navigations

Here, you will find the sample packs that correspond with the chapter walkthroughs and challenges in the book. Please note that there is live malware in these archives in several instances. As such, the archives are password protected with the password "infected".

All of the code is organized into folders. For example, Chapter02.

The code will look like the following:

if (test expression)
{
  Statement upon condition is true
}

Following is what you need for this book: This book is for incident response professionals, malware analysts, and researchers who want to sharpen their skillset or are looking for a reference for common static and dynamic analysis techniques. Beginners will also find this book useful to get started with learning about malware analysis. Basic knowledge of command-line interfaces, familiarity with Windows and Unix-like filesystems and registries, and experience in scripting languages such as PowerShell, Python, or Ruby will assist with understanding the concepts covered.

With the following software and hardware list you can run all code files present in the book (Chapter 1-11).

Software and Hardware List

Chapter	Software required	OS required
1-11	VMware Fusion, VirtualBox, or VMware Workstation	Windows or macOS
1-11	FlareVM	Windows or macOS

We also provide a PDF file that has color images of the screenshots/diagrams used in this book. Click here to download it.

Get to Know the Author

Dylan Barker is a technology professional with ten years’ experience in the information security space, in industries ranging from K12 and telecom to financial services. He has held many distinct roles from security infrastructure engineering to vulnerability management. In the past, he has spoken at BSides events, and has written articles for CrowdStrike - where he is currently employed as a Senior Analyst.

Download a free PDF

If you have already purchased a print or Kindle version of this book, you can get a DRM-free PDF version at no cost.
Simply click on the link to claim your free PDF.

https://packt.link/free-ebook/9781839212277

malware-analysis-techniques's People

Contributors

Stargazers

Watchers

Forkers

nocomp stjordanis thenutter mrvn2018 koleademola xiaoyuge16 dearfuture dkhuuthe innovationexploited prazcrypto classic130 tnt2402 pickkaa ndolle thantzinbluethings arun2dot0 leungrhy phasekillah guralsyncalypse

malware-analysis-techniques's Issues

Password protected .zip files

The malware sample packs for each chapter are password protected, have I missed where this password was provided or something?

TrickBot does not have a macro

The TricBot.xls in chapter3.zip does not have a macro. I opened the file and there is no "enable editing" bar, then I checked the macro editor, and there is no macro. Did I miss something?
Alos, the chapter 6 of the book uses TricBot as an example, but the code is included in chapter3.zip. Chapter6.zip include a sample called unknown.exe, which is used in Chapter 5. It looks like the sample code is misplaced.

Please help @Packt-ITService @AbsoZed

Missing sample for Chapter 5

The _dump2.exe sample for demonstrating Ghidra is missing from the Chapter 5 Archive. The sample included in the Chapter 5 Archive is for Chapter 6.

Missing information or incomplete samples

Hey,

I have been looking through the first 3 chapters of the book and it feels like a lot of the practical examples are unclear, incomplete or there is contradictory information.

In the second chapter ssdeep and filetype are referenced as necessary programs. However, on page 31 the supposed link to ssdeep is just a link to this github repository where, as far as I am aware, no such binary exists. As such you are left to find these for yourself.

The same problem exists for the filetype.exe program which again uses a reference to this github and not a link to where one can find this program (page 36).

On page 44 we start with the examination of Emotet but this sample is not in the corresponding zip. Unclear if this wasn't meant to be a follow along example.

There is contradicting information at the beginning of every chapter where it states that an internet connection is required where as it was emphasized that one should never have an open internet connection in their VM. For beginners this is really confusing especially when they have no grasp of the consequences or executions certain malware samples may perform.

As far as I can see there are also some problems with the challenges.

Examples:
In the Chapter 2 zip there are currently 4 malware samples all required to work along with the second chapter in the book. It would be logical to think that the corresponding samples required for challenge 1 and 2 are also in this same folder.

The first challenge seems to focus mainly on sample.dll in the chapter 2 zip but isn't mentioned anywhere explicitly.

The second challenge references a sample that is not present in the chapter 2 or any subsequent zip folders and I doubt you are supposed as a beginner to look for a sample of wannacry. If this was indeed the case then this was unclear.

For the third challenge you are supposed to again use a sample link so I am assuming you are supposed to use the one in the chapter 3 zip; Trickbot.xls. However, if one has followed the instructions of setting up the VM you will not be equipped with a program to open the file.

These are the first few things I ran into that I found troublesome and I am afraid I will bump into more.

Solutions:

If network connectivity during malware execution is not dangerous for the host, explicitly state so in a readme file in the desginated folder.
This simple readme in each zip folder could also be used to indicate which sample belongs to which challenge which would be great.
To actually include all the samples used in the book would also be great.
Another idea is that instead of having the readers type out each line from the powershell script, just include the final script since this minimizes the risk of typing errors which may cause the reader to stop since they may not know what they are doing if something goes wrong.

There also seems to be a problem with the script:
$Before = Get-Date yyyy/mm/dd $After = Get-Date yyyy/mm/dd Get-WinEvent -FilterHashtable @{LogName = 'Security'; StartTime = $After; EndTime = $Before; Id = '4624'} | Where {$_.Message -match "Logon Type:=\s+10"} | Select TimeCreated, Message

Produces the following error:
Get-WinEvent : No events were found that match the specified selection criteria. At {Path to shell script} ... \+ Get-WinEvent - FilterHashtable @{LogName = 'Security'; ... \+ CategoryInfo : ObjectNotFound: (:) [Get-WinEvent], Exception \+ FullyQualifiedErrorId: NoMatchingEventsFound,Microsoft.Powershell.Commands.GetWinEventCommand

as well as the fact that the pattern matching for seems to return nothing.

I hope these problems can be fixed with additional files in this malware repo.