Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
Michael Sikorski
Andrew Honig
Published by No Starch Press
Praise for Practical Malware Analysis
Digital Forensics Book of the Year , F ORENSIC 4 CAST A WARDS 2013
A hands-on introduction to malware analysis. Id recommend it to anyone who wantsto dissect Windows malware.
Ilfak Guilfanov , C REATOROF IDA P RO
The book every malware analyst should keep handy.
Richard Bejtlich , CSO OF M ANDIANT & F OUNDER OF T AO S ECURITY
This book does exactly what it promises on the cover; its crammed with detailand has an intensely practical approach, but its well organised enough that you can keep itaround as handy reference.
Mary Branscombe , ZDN ET
If youre starting out in malware analysis, or if you are coming to analysis from another discipline, Id recommend having a nose.
Paul Baccas , N AKED S ECURITY FROM S OPHOS
An excellent crash course in malware analysis.
Dino Dai Zovi , I NDEPENDENT S ECURITY C ONSULTANT
The most comprehensive guide to analysis of malware, offering detailed coverageof all the essential skills required to understand the specific challenges presented by modernmalware.
Chris Eagle , S ENIOR L ECTURER OF C OMPUTER S CIENCE AT THE N AVAL P OSTGRADUATE S CHOOL
A great introduction to malware analysis. All chapters contain detailed technicalexplanations and hands-on lab exercises to get you immediate exposure to real malware.
Sebastian Porst , G OOGLE S OFTWARE E NGINEER
Brings reverse-engineering to readers of all skill levels. Technically rich andaccessible, the labs will lead you to a deeper understanding of the art and science ofreverse-engineering. I strongly believe this will become the defacto text for learning malware analysis in the future.
Danny Quist , P H D, F OUNDER OF O FFENSIVE C OMPUTING
An awesome book...written by knowledgeable authors who possess the rare gift of being able to communicate their knowledge through the written word.
Richard Austin , IEEE C IPHER
If you only read one malware book or are looking to break into the world of malwareanalysis, this is the book to get.
Patrick Engbretson , IA P ROFESSOR , D AKOTA S TATE U NIVERSITY AND A UTHOROF The Basics of Hacking and Pen Testing
An excellent addition to the course materials for an advanced graduate levelcourse on Software Security or Intrusion Detection Systems. The labs are especially useful tostudents in teaching the methods to reverse-engineer, analyze, and understand malicioussoftware.
Sal Stolfo , P ROFESSOR , C OLUMBIA U NIVERSITY
The explanation of the tools is clear, the presentation of the process is lucid, and the actual detective work fascinating. All presented clearly and hitting just the right level so that developers with no previous experience in this particular area can participate fully. Highly recommended.
Dr. Dobbs
This book is like having your very own personal malware analysis teacher without theexpensive training costs.
Dustin Schultz , T HE X PLOIT
I highly recommend this book to anyone looking to get their feet wet in malware analysis or just looking for a good desktop reference on the subject.
Pete Arzamendi , 403L ABS
I do not see how anyone who has hands-on responsibility for security of Windows systems can rationalize not being familiar with these tools.
Stephen Northcutt , SANS I NSTITUTE
Warning
This is a book about malware. The links and software described in this book are malicious . Exercise extreme caution when executing unknown code and visitinguntrusted URLs.
For hints about creating a safe virtualized environment for malware analysis, visit . Dont be stupid; secure yourenvironment.
About the Authors
Michael Sikorski is a computer security consultant atMandiant. He reverse-engineers malicious software in support of incident response investigations andprovides specialized research and development security solutions to the companys federalclient base. Mike created a series of courses in malware analysis and teaches them to a variety ofaudiences including the FBI and Black Hat. He came to Mandiant from MIT Lincoln Laboratory, where heperformed research in passive network mapping and penetration testing. Mike is also a graduate ofthe NSAs three-year System and Network Interdisciplinary Program (SNIP). While at the NSA, hecontributed to research in reverse-engineering techniques and received multiple invention awards inthe field of network analysis.
Andrew Honig is an information assurance expert for theDepartment of Defense. He teaches courses on software analysis, reverse-engineering, and Windowssystem programming at the National Cryptologic School and is a Certified Information SystemsSecurity Professional. Andy is publicly credited with several zero-day exploits in VMwaresvirtualization products and has developed tools for detecting innovative malicious software,including malicious software in the kernel. An expert in analyzing and understanding both maliciousand non-malicious software, he has over 10 years of experience as an analyst in the computersecurity industry.
About the Technical Reviewer
Stephen Lawler is the founder and president of a smallcomputer software and security consulting firm. Stephen has been actively working in informationsecurity for over seven years, primarily in reverse-engineering, malware analysis, and vulnerabilityresearch. He was a member of the Mandiant Malware Analysis Team and assisted with high-profilecomputer intrusions affecting several Fortune 100 companies. Previously he worked in ManTechInternationals Security and Mission Assurance (SMA) division, where he discovered numerouszero-day vulnerabilities and software exploitation techniques as part of ongoing software assuranceefforts. In a prior life that had nothing to do with computer security, he was lead developer forthe sonar simulator component of the US Navy SMMTT program.
About the Contributing Authors
Nick Harbour is a malware analyst at Mandiant and aseasoned veteran of the reverse-engineering business. His 13-year career in information securitybegan as a computer forensic examiner and researcher at the Department of Defense Computer ForensicsLaboratory. For the last six years, Nick has been with Mandiant and has focused primarily on malwareanalysis. He is a researcher in the field of anti-reverse-engineering techniques, and he has writtenseveral packers and code obfuscation tools, such as PE-Scrambler. He has presented at Black Hat andDefcon several times on the topic of anti-reverse-engineering and anti-forensics techniques. He isthe primary developer and teacher of a Black Hat Advanced Malware Analysis course.
Lindsey Lack is a technical director at Mandiant with overtwelve years of experience in information security, specializing in malware reverse-engineering,network defense, and security operations. He has helped to create and operate a Security OperationsCenter, led research efforts in network defense, and developed secure hosting solutions. He haspreviously held positions at the National Information Assurance Research Laboratory, the ExecutiveOffice of the President (EOP), Cable and Wireless, and the US Army. In addition to abachelors degree in computer science from Stanford University, Lindsey has also received amasters degree in computer science with an emphasis in information assurance from the NavalPostgraduate School.