Practical Malware Analysis The Hands-On Guide to Dissecting Malicious Software

ISBN-10: 1593272901
ISBN-13: 9781593272906
Edition: 2011
List price: $62.95 Buy it from $43.22
This item qualifies for FREE shipping

*A minimum purchase of $35 is required. Shipping is provided via FedEx SmartPost® and FedEx Express Saver®. Average delivery time is 1 – 5 business days, but is not guaranteed in that timeframe. Also allow 1 - 2 days for processing. Free shipping is eligible only in the continental United States and excludes Hawaii, Alaska and Puerto Rico. FedEx service marks used by permission."Marketplace" orders are not eligible for free or discounted shipping.

30 day, 100% satisfaction guarantee

If an item you ordered from TextbookRush does not meet your expectations due to an error on our part, simply fill out a return request and then return it by mail within 30 days of ordering it for a full refund of item cost.

Learn more about our returns policy

Description: There are more than 100 malicious computer attacks every second, resulting in tens of billions of dollars in economic damages each year. Among security professionals, the skills required to quickly analyze and assess these attacks are in high  More...

New Starting from $43.22
what's this?
Rush Rewards U
Members Receive:
coins
coins
You have reached 400 XP and carrot coins. That is the daily max!
You could win $10,000

Get an entry for every item you buy, rent, or sell.

Study Briefs

Limited time offer: Get the first one free! (?)

All the information you need in one place! Each Study Brief is a summary of one specific subject; facts, figures, and explanations to help you learn faster.

Add to cart
Study Briefs
Italian Grammar Online content $4.95 $1.99
Add to cart
Study Briefs
Portuguese Grammar Online content $4.95 $1.99
Add to cart
Study Briefs
Spanish Grammar Online content $4.95 $1.99
Add to cart
Study Briefs
German Grammar Online content $4.95 $1.99

Customers also bought

Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading

Book details

List price: $62.95
Copyright year: 2011
Publisher: No Starch Press, Incorporated
Publication date: 2/29/2012
Binding: Paperback
Pages: 500
Size: 7.00" wide x 9.25" long x 1.75" tall
Weight: 2.728
Language: English

There are more than 100 malicious computer attacks every second, resulting in tens of billions of dollars in economic damages each year. Among security professionals, the skills required to quickly analyze and assess these attacks are in high demand. Practical Malware Analysis provides a rapid introduction to the tools and methods used to dissect malicious software (malware), showing readers how to discover, debug, and disassemble these threats. The book goes on to examine how to overcome the evasive techniques--stealth, code obfuscation, encryption, file packing, and others--that malware authors use to thwart attempts to reverse engineer their programs. Key chapters include a lab at the end, which reviews important concepts from the discussion in the context of real-world malware examples. Drawn from the authors' extensive field experience combating malware, these labs make Practical Malware Analysis the perfect teaching tool for beginners and seasoned veterans alike.

Michael Sikorski is a Principal Consultant at Mandiant. He provides specialized research and development security solutions to the company's federal client base, reverse engineers malicious software discovered by incident responders, and has helped create a series of courses in malware analysis (from Beginner to Advanced). He has taught these courses to a variety of audiences including the FBI, the National Security Agency (NSA), and BlackHat. A former member of MIT's Lincoln Laboratory and the NSA, he holds a Top Secret security clearance.

Andrew Honig is an Information Assurance Expert for the Department of Defense. He teaches courses on software analysis, reverse engineering, and Windows system programming. Andy is publicly credited with several zero-day exploits in VMware's virtualization products.

Praise for Practical Malware Analysis
Warning
About The Authors
About the Technical Reviewer
About the Contributing Authors; Foreword
Acknowledgments
Individual Thanks
Introduction
What Is Malware Analysis?
Prerequisites
Practical, Hands-On Learning
What's in the Book?
Malware Analysis Primer
The Goals of Malware Analysis
Malware Analysis Techniques
Types of Malware
General Rules for Malware Analysis; Basic Analysis
Basic Static Techniques
Antivirus Scanning: A Useful First Step
Hashing: A Fingerprint for Malware
Finding Strings
Packed and Obfuscated Malware
Portable Executable File Format
Linked Libraries and Functions
Static Analysis in Practice
The PE File Headers and Sections
Conclusion
Labs
Malware Analysis in Virtual Machines
The Structure of a Virtual Machine
Creating Your Malware Analysis Machine
Using Your Malware Analysis Machine
The Risks of Using VMware for Malware Analysis
Record/Replay: Running Your Computer in Reverse
Conclusion
Basic Dynamic Analysis
Sandboxes: The Quick-and-Dirty Approach
Running Malware
Monitoring with Process Monitor
Viewing Processes with Process Explorer
Comparing Registry Snapshots with Regshot
Faking a Network
Packet Sniffing with Wireshark
Using INetSim
Basic Dynamic Tools in Practice
Conclusion
Labs; Advanced Static Analysis
A Crash Course in x86 Disassembly
Levels of Abstraction
Reverse-Engineering
The x86 Architecture
Conclusion
IDA Pro
Loading an Executable
The IDA Pro Interface
Using Cross-References
Analyzing Functions
Using Graphing Options
Enhancing Disassembly
Extending IDA with Plug-ins
Conclusion
Labs
Recognizing C Code Constructs in Assembly
Global vs. Local Variables
Disassembling Arithmetic Operations
Recognizing if Statements
Recognizing Loops
Understanding Function Call Conventions
Analyzing switch Statements
Disassembling Arrays
Identifying Structs
Analyzing Linked List Traversal
Conclusion
Labs
Analyzing Malicious Windows Programs
The Windows API
The Windows Registry
Networking APIs
Following Running Malware
Kernel vs. User Mode
The Native API
Conclusion
Labs; Advanced Dynamic Analysis
Debugging
Source-Level vs. Assembly-Level Debuggers
Kernel vs. User-Mode Debugging
Using a Debugger
Exceptions
Modifying Execution with a Debugger
Modifying Program Execution in Practice
Conclusion
OllyDbg
Loading Malware
The OllyDbg Interface
Memory Map
Viewing Threads and Stacks
Executing Code
Breakpoints
Loading DLLs
Tracing
Exception Handling
Patching
Analyzing Shellcode
Assistance Features
Plug-ins
Scriptable Debugging
Conclusion
Labs
Kernel Debugging with WinDbg
Drivers and Kernel Code
Setting Up Kernel Debugging
Using WinDbg
Microsoft Symbols
Kernel Debugging in Practice
Rootkits
Loading Drivers
Kernel Issues for Windows Vista, Windows 7, and x64 Versions
Conclusion
Labs; Malware Functionality
Malware Behavior
Downloaders and Launchers
Backdoors
Credential Stealers
Persistence Mechanisms
Privilege Escalation
Covering Its Tracks—User-Mode Rootkits
Conclusion
Labs
Covert Malware Launching
Launchers
Process Injection
Process Replacement
Hook Injection
Detours
APC Injection
Conclusion
Labs
Data Encoding
The Goal of Analyzing Encoding Algorithms
Simple Ciphers
Common Cryptographic Algorithms
Custom Encoding
Decoding
Conclusion
Labs
Malware-Focused Network Signatures
Network Countermeasures
Safely Investigate an Attacker Online
Content-Based Network Countermeasures
Combining Dynamic and Static Analysis Techniques
Understanding the Attacker's Perspective
Conclusion
Labs; Anti-Reverse-Engineering
Anti-Disassembly
Understanding Anti-Disasseeeeeembly
Defeating Disassembly Algorithms
Anti-Disassembly Techniques
Obscuring Flow Control
Thwarting Stack-Frame Analysis
Conclusion
Labs
Anti-Debugging
Windows Debugger Detection
Identifying Debugger Behavior
Interfering with Debugger Functionality
Debugger Vulnerabilities
Conclusion
Labs
Anti-Virtual Machine Techniques
VMware Artifacts
Vulnerable Instructions
Tweaking Settings
Escaping the Virtual Machine
Conclusion
Labs
Packers and Unpacking
Packer Anatomy
Identifying Packed Programs
Unpacking Options
Automated Unpacking
Manual Unpacking
Tips and Tricks for Common Packers
Analyzing Without Fully Unpacking
Packed DLLs
Conclusion
Labs; Special Topics
Shellcode Analysis
Loading Shellcode for Analysis
Position-Independent Code
Identifying Execution Location
Manual Symbol Resolution
A Full Hello World Example
Shellcode Encodings
NOP Sleds
Finding Shellcode
Conclusion
Labs
C++ Analysis
Object-Oriented Programming
Virtual vs. Nonvirtual Functions
Creating and Destroying Objects
Conclusion
Labs
64-Bit Malware
Why 64-Bit Malware?
Differences in x64 Architecture
Windows 32-Bit on Windows 64-Bit
64-Bit Hints at Malware Functionality
Conclusion
Labs
Important Windows Functions
Tools for Malware Analysis
Solutions to Labs
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions
Solutions

×
Free shipping on orders over $35*

*A minimum purchase of $35 is required. Shipping is provided via FedEx SmartPost® and FedEx Express Saver®. Average delivery time is 1 – 5 business days, but is not guaranteed in that timeframe. Also allow 1 - 2 days for processing. Free shipping is eligible only in the continental United States and excludes Hawaii, Alaska and Puerto Rico. FedEx service marks used by permission."Marketplace" orders are not eligible for free or discounted shipping.

Learn more about the TextbookRush Marketplace.

×