Windows Malware Analysis Essentials - Softcover

Victor Marak

Softcover

ISBN 10: 1785281518 ISBN 13: 9781785281518

Publisher: Packt Publishing - ebooks Account, 2015

Synopsis

Master the fundamentals of malware analysis for the Windows platform and enhance your anti-malware skill set

About This Book

• Set the baseline towards performing malware analysis on the Windows platform and how to use the tools required to deal with malware
• Understand how to decipher x86 assembly code from source code inside your favourite development environment
• A step-by-step based guide that reveals malware analysis from an industry insider and demystifies the process

Who This Book Is For

This book is best for someone who has prior experience with reverse engineering Windows executables and wants to specialize in malware analysis. The book presents the malware analysis thought process using a show-and-tell approach, and the examples included will give any analyst confidence in how to approach this task on their own the next time around.

What You Will Learn

• Use the positional number system for clear conception of Boolean algebra, that applies to malware research purposes
• Get introduced to static and dynamic analysis methodologies and build your own malware lab
• Analyse destructive malware samples from the real world (ITW) from fingerprinting and static/dynamic analysis to the final debrief
• Understand different modes of linking and how to compile your own libraries from assembly code and integrate the codein your final program
• Get to know about the various emulators, debuggers and their features, and sandboxes and set them up effectively depending on the required scenario
• Deal with other malware vectors such as pdf and MS-Office based malware as well as scripts and shellcode

In Detail

Windows OS is the most used operating system in the world and hence is targeted by malware writers. There are strong ramifications if things go awry. Things will go wrong if they can, and hence we see a salvo of attacks that have continued to disrupt the normal scheme of things in our day to day lives. This book will guide you on how to use essential tools such as debuggers, disassemblers, and sandboxes to dissect malware samples. It will expose your innards and then build a report of their indicators of compromise along with detection rule sets that will enable you to help contain the outbreak when faced with such a situation.

We will start with the basics of computing fundamentals such as number systems and Boolean algebra. Further, youll learn about x86 assembly programming and its integration with high level languages such as C++.Youll understand how to decipher disassembly code obtained from the compiled source code and map it back to its original design goals.

By delving into end to end analysis with real-world malware samples to solidify your understanding, youll sharpen your technique of handling destructive malware binaries and vector mechanisms. You will also be encouraged to consider analysis lab safety measures so that there is no infection in the process.

Finally, well have a rounded tour of various emulations, sandboxing, and debugging options so that you know what is at your disposal when you need a specific kind of weapon in order to nullify the malware.

About this title

About the Author

Victor Marak

Victor Marak is a security researcher, an electronic musician, and a world backpacker. He is a college dropout and an autodidact, and he loves working on interesting subjects such as medieval music composition, demonology, DSP electronics, and psychology. He has worked for start-ups, mid-tier, and fortune 500 companies with 5 years of experience in anti-virus technologies and malware research. He was into music production prior to joining the anti-malware industry, and his solo projects are on the world's largest electronic dance music market― Beatport, as well as other major retailers like iTunes, Amazon and Traxxsource. He is in perpetual backpacking mode, set to globe-trotting, especially to his favorite countries in Europe and Russia. He can be found hanging around in the wrong social networks - LinkedIn and Quora. This is his first book.

Edition details

• Publisher: Packt Publishing - ebooks Account
• Publication date: 2015
• ISBN 10: 1785281518
• ISBN 13: 9781785281518
• Binding: Paperback
• Language: English
• Number of pages: 273