Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
Michael Sikorski
Andrew Honig
Copyright 2012
PRACTICAL MALWARE ANALYSIS. Copyright 2012 by Michael Sikorski and Andrew Honig.
All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher.
16 15 14 13 12 1 2 3 4 5 6 7 8 9
ISBN-10: 1-59327-290-1
Publisher: William Pollock
Production Editor: Alison Law
Cover Illustration: Hugh DAndrade
Interior Design: Octopod Studios
Developmental Editors: William Pollock and Tyler Ortman
Technical Reviewer: Stephen Lawler
Copyeditor: Marilyn Smith
Compositor: Riley Hoffman
Proofreader: Irene Barnard
Indexer: Nancy Guenther
For information on book distributors or translations, please contact No Starch Press, Inc. directly:
Library of Congress Cataloging-in-Publication Data
A catalog record of this book is available from the Library of Congress.
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark.
The information in this book is distributed on an As Is basis, without warranty. While every precaution has been taken in the preparation of this work, neither the authors nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it.
No Starch Press
Praise for Practical Malware Analysis
An excellent crash course in malware analysis.
Dino Dai Zovi , I NDEPENDENT S ECURITY C ONSULTANT
... the most comprehensive guide to analysis of malware, offering detailed coverage of all the essential skills required to understand the specific challenges presented by modern malware.
Chris Eagle , S ENIOR L ECTURER OF C OMPUTER S CIENCE , N AVAL P OSTGRADUATE S CHOOL
A hands-on introduction to malware analysis. Id recommend it to anyone who wants to dissect Windows malware.
Ilfak Guilfanov , C REATOR OF IDA P RO
... a great introduction to malware analysis. All chapters contain detailed technical explanations and hands-on lab exercises to get you immediate exposure to real malware.
Sebastian Porst , G OOGLE S OFTWARE E NGINEER
... brings reverse-engineering to readers of all skill levels. Technically rich and accessible, the labs will lead you to a deeper understanding of the art and science of reverse-engineering. I strongly recommend this book for beginners and experts alike.
Danny Quist , P H D, F OUNDER OF O FFENSIVE C OMPUTING
If you only read one malware book or are looking to break into the world of malware analysis, this is the book to get.
Patrick Engbretson , IA P ROFESSOR , D AKOTA S TATE U NIVERSITY AND A UTHOR OF The Basics of Hacking and Pen Testing
... an excellent addition to the course materials for an advanced graduate level course on Software Security or Intrusion Detection Systems. The labs are especially useful to students in teaching the methods to reverse-engineer, analyze, and understand malicious software.
Sal Stolfo , P ROFESSOR , C OLUMBIA U NIVERSITY
Warning
This is a book about malware. The links and software described in this book are malicious . Exercise extreme caution when executing unknown code and visiting untrusted URLs.
For hints about creating a safe virtualized environment for malware analysis, visit . Dont be stupid; secure your environment.
About the Authors
Michael Sikorski is a computer security consultant at Mandiant. He reverse-engineers malicious software in support of incident response investigations and provides specialized research and development security solutions to the companys federal client base. Mike created a series of courses in malware analysis and teaches them to a variety of audiences including the FBI and Black Hat. He came to Mandiant from MIT Lincoln Laboratory, where he performed research in passive network mapping and penetration testing. Mike is also a graduate of the NSAs three-year System and Network Interdisciplinary Program (SNIP). While at the NSA, he contributed to research in reverse-engineering techniques and received multiple invention awards in the field of network analysis.
Andrew Honig is an information assurance expert for the Department of Defense. He teaches courses on software analysis, reverse-engineering, and Windows system programming at the National Cryptologic School and is a Certified Information Systems Security Professional. Andy is publicly credited with several zero-day exploits in VMwares virtualization products and has developed tools for detecting innovative malicious software, including malicious software in the kernel. An expert in analyzing and understanding both malicious and non-malicious software, he has over 10 years of experience as an analyst in the computer security industry.
About the Technical Reviewer
Stephen Lawler is the founder and president of a small computer software and security consulting firm. Stephen has been actively working in information security for over seven years, primarily in reverse-engineering, malware analysis, and vulnerability research. He was a member of the Mandiant Malware Analysis Team and assisted with high-profile computer intrusions affecting several Fortune 100 companies. Previously he worked in ManTech Internationals Security and Mission Assurance (SMA) division, where he discovered numerous zero-day vulnerabilities and software exploitation techniques as part of ongoing software assurance efforts. In a prior life that had nothing to do with computer security, he was lead developer for the sonar simulator component of the US Navy SMMTT program.
About the Contributing Authors
Nick Harbour is a malware analyst at Mandiant and a seasoned veteran of the reverse-engineering business. His 13-year career in information security began as a computer forensic examiner and researcher at the Department of Defense Computer Forensics Laboratory. For the last six years, Nick has been with Mandiant and has focused primarily on malware analysis. He is a researcher in the field of anti-reverse-engineering techniques, and he has written several packers and code obfuscation tools, such as PE-Scrambler. He has presented at Black Hat and Defcon several times on the topic of anti-reverse-engineering and anti-forensics techniques. He is the primary developer and teacher of a Black Hat Advanced Malware Analysis course.
Lindsey Lack is a technical director at Mandiant with over twelve years of experience in information security, specializing in malware reverse-engineering, network defense, and security operations. He has helped to create and operate a Security Operations Center, led research efforts in network defense, and developed secure hosting solutions. He has previously held positions at the National Information Assurance Research Laboratory, the Executive Office of the President (EOP), Cable and Wireless, and the US Army. In addition to a bachelors degree in computer science from Stanford University, Lindsey has also received a masters degree in computer science with an emphasis in information assurance from the Naval Postgraduate School.