| Document Type
|
:
|
BL
|
| Record Number
|
:
|
856517
|
| Main Entry
|
:
|
K. A, Monnappa.
|
| Title & Author
|
:
|
Learning Malware Analysis : : Explore the Concepts, Tools, and Techniques to Analyze and Investigate Windows Malware.
|
| Publication Statement
|
:
|
Birmingham :: Packt Publishing Ltd,, 2018.
|
| Page. NO
|
:
|
1 online resource (500 pages)
|
| ISBN
|
:
|
1788392507
|
|
|
:
|
: 1788397525
|
|
|
:
|
: 9781788392501
|
|
|
:
|
: 9781788397520
|
|
|
:
|
1788392507
|
|
|
:
|
9781788392501
|
| Notes
|
:
|
2.2 Instruction Pointer (EIP).
|
| Contents
|
:
|
Cover; Title Page; Copyright and Credits; Dedication; Packt Upsell; Contributors; Table of Contents; Preface; Chapter 1: Introduction to Malware Analysis; 1. What Is Malware?; 2. What Is Malware Analysis?; 3. Why Malware Analysis?; 4. Types Of Malware Analysis; 5. Setting Up The Lab Environment; 5.1 Lab Requirements; 5.2 Overview Of Lab Architecture; 5.3 Setting Up And Configuring Linux VM; 5.4 Setting Up And Configuring Windows VM; 6. Malware Sources; Summary; Chapter 2: Static Analysis; 1. Determining the File Type; 1.1 Identifying File Type Using Manual Method.
|
|
|
:
|
1.2 Identifying File Type Using Tools1.3 Determining File Type Using Python; 2. Fingerprinting the Malware; 2.1 Generating Cryptographic Hash Using Tools; 2.2 Determining Cryptographic Hash in Python; 3. Multiple Anti-Virus Scanning; 3.1 Scanning the Suspect Binary with VirusTotal; 3.2 Querying Hash Values Using VirusTotal Public API; 4. Extracting Strings; 4.1 String Extraction Using Tools; 4.2 Decoding Obfuscated Strings Using FLOSS; 5. Determining File Obfuscation; 5.1 Packers and Cryptors; 5.2 Detecting File Obfuscation Using Exeinfo PE; 6. Inspecting PE Header Information.
|
|
|
:
|
3. Dynamic Analysis (Monitoring) Tools3.1 Process Inspection with Process Hacker; 3.2 Determining System Interaction with Process Monitor; 3.3 Logging System Activities Using Noriben; 3.4 Capturing Network Traffic With Wireshark; 3.5 Simulating Services with INetSim; 4. Dynamic Analysis Steps; 5. Putting it All Together: Analyzing a Malware Executable; 5.1 Static Analysis of the Sample; 5.2 Dynamic Analysis of the Sample; 6. Dynamic-Link Library (DLL) Analysis; 6.1 Why Attackers Use DLLs; 6.2 Analyzing the DLL Using rundll32.exe; 6.2.1 Working of rundll32.exe.
|
|
|
:
|
6.1 Inspecting File Dependencies and Imports6.2 Inspecting Exports; 6.3 Examining PE Section Table And Sections; 6.4 Examining the Compilation Timestamp; 6.5 Examining PE Resources; 7. Comparing And Classifying The Malware; 7.1 Classifying Malware Using Fuzzy Hashing; 7.2 Classifying Malware Using Import Hash; 7.3 Classifying Malware Using Section Hash; 7.4 Classifying Malware Using YARA; 7.4.1 Installing YARA; 7.4.2 YARA Rule Basics; 7.4.3 Running YARA; 7.4.4 Applications of YARA; Summary; Chapter 3: Dynamic Analysis; 1. Lab Environment Overview; 2. System And Network Monitoring.
|
|
|
:
|
6.2.2 Launching the DLL Using rundll32.exeExample 1 -- Analyzing a DLL With No Exports; Example 2 -- Analyzing a DLL Containing Exports; Example 3 -- Analyzing a DLL Accepting Export Arguments; 6.3 Analyzing a DLL with Process Checks; Summary; Chapter 4: Assembly Language and Disassembly Primer; 1. Computer Basics; 1.1 Memory; 1.1.1 How Data Resides In Memory; 1.2 CPU; 1.2.1 Machine Language; 1.3 Program Basics; 1.3.1 Program Compilation; 1.3.2 Program On Disk; 1.3.3 Program In Memory; 1.3.4 Program Disassembly (From Machine code To Assembly code); 2. CPU Registers; 2.1 General-Purpose Registers.
|
| Abstract
|
:
|
Malware analysis and memory forensics are powerful analysis and investigation techniques used in reverse engineering, digital forensics, and incident response. This book teaches you the concepts, tools, and techniques to determine the behavior and characteristics of malware using malware analysis and memory forensics.
|
| Subject
|
:
|
Computer security.
|
| Subject
|
:
|
Computer software-- Evaluation.
|
| Subject
|
:
|
Malware.
|
| Subject
|
:
|
Computer security.
|
| Subject
|
:
|
Computer software-- Evaluation.
|
| Subject
|
:
|
Microsoft Windows (Computer file)
|
|
|
:
|
Microsoft Windows (Computer file)
|
| Dewey Classification
|
:
|
005.84
|
| LC Classification
|
:
|
QA76.76.C68.M666 2018
|