Practical Malware Analysis


Malware analysis is big business, and attacks can cost a company dearly. When malware breaches your defenses, you need to act quickly to cure current infections and prevent future ones from occurring.

For those who want to stay ahead of the latest malware, Practical Malware Analysis will teach you the tools and techniques used by professional analysts. With this book as your guide, you’ll be able to safely analyze, debug, and disassemble any malicious software that comes your way.

You’ll learn how to:

  • Set up a safe virtual environment to analyze malware
  • Quickly extract network signatures and host-based indicators
  • Use key analysis tools like IDA Pro, OllyDbg, and WinDbg
  • Overcome malware tricks like obfuscation, anti-disassembly, anti-debugging, and anti-virtual machine techniques
  • Use your newfound knowledge of Windows internals for malware analysis
  • Develop a methodology for unpacking malware and get practical experience with five of the most popular packers
  • Analyze special cases of malware with shellcode, C++, and 64-bit code

Hands-on labs throughout the book challenge you to practice and synthesize your skills as you dissect real malware samples, and pages of detailed dissections offer an over-the-shoulder look at how the pros do it. You’ll learn how to crack open malware to see how it really works, determine what damage it has done, thoroughly clean your network, and ensure that the malware never comes back.

Table of Contents
Chapter 1. Malware Analysis Primer

Part I: Basic Analysis
Chapter 2. Basic Static Techniques
Chapter 3. Malware Analysis in Virtual Machines
Chapter 4. Basic Dynamic Analysis

Part II: Advanced Static Analysis
Chapter 5. A Crash Course in x86 Disassembly
Chapter 6. IDA Pro
Chapter 7. Recognizing C Code Constructs in Assembly
Chapter 8. Analyzing Malicious Windows Programs

Part III: Advanced Dynamic Analysis
Chapter 9. Debugging
Chapter 10. OllyDbg
Chapter 11. Kernel Debugging with WinDbg

Part IV: Malware Functionality
Chapter 12. Malware Behavior
Chapter 13. Covert Malware Launching
Chapter 14. Data Encoding
Chapter 15. Malware-Focused Network Signatures

Part V: Anti-Reverse-Engineering
Chapter 16. Anti-Disassembly
Chapter 17. Anti-Debugging
Chapter 18. Anti-Virtual Machine Techniques
Chapter 19. Packers and Unpacking

Part VI: Special Topics
Chapter 20. Shellcode Analysis
Chapter 21. C++ Analysis
Chapter 22. 64-Bit Malware

Appendix. Important Windows Functions
Appendix. Tools for Malware Analysis
Appendix. Solutions to Labs

Book Details

  • Paperback: 800 pages
  • Publisher: No Starch Press (February 2012)
  • Language: English
  • ISBN-10: 1593272901
  • ISBN-13: 978-1593272906
Download [19.8 MiB]

You may also like...

Leave a Reply