Skip to content

malware-analysis.md

Latest commit

 

History

History
44 lines (37 loc) · 2.24 KB

malware-analysis.md

File metadata and controls

44 lines (37 loc) · 2.24 KB
Raw
title Malware Analysis
type technique
tags
exploit-dev
binary
malware
reverse-engineering
injection
windows
phase exploitation
date_created 2026-07-14
date_updated 2026-07-14
sources
hacktricks-binexp

Malware Analysis

Triaging Windows samples by their imports and recognizing the common code-injection recipes. Generic RE methodology and tooling: [[reverse-engineering]].

Malware analysis: common APIs and injection techniques

Triage a Windows sample by its imports (IAT) to guess capability fast:

  • Networking: WSAStartup/connect/send/recv; loaders often wrap in SslStream with cert pinning and gzip-chunk (~16 KB) transport to dodge size heuristics.
  • Persistence: RegCreateKeyEx/RegSetValueEx, CreateService/StartServiceCtrlDispatcher, CopyFile/CreateFile+WriteFile.
  • Crypto: CryptAcquireContext/CryptDeriveKey/CryptDecrypt (WinCrypt); strings often RC4/AES per-string, decrypted only at runtime.
  • Injection/stealth: VirtualAlloc(Ex), VirtualProtect, WriteProcessMemory, CreateRemoteThread, NtUnmapViewOfSection, QueueUserAPC, SetThreadContext.
  • Execution: CreateProcess, ShellExecute, WinExec, ResumeThread.
  • Recon/keylog/screenshot: GetAsyncKeyState, SetWindowsHookEx, GetForegroundWindow, CreateToolhelp32Snapshot, GetDC+BitBlt.

Injection recipes to recognize:

  • DLL injection: OpenProcess -> VirtualAllocEx -> WriteProcessMemory(dllpath) -> CreateRemoteThread(LoadLibrary).
  • Reflective DLL: maps + relocates + calls DllMain with no LoadLibrary (no module in PEB list).
  • Process Hollowing / RunPE: CreateProcess(CREATE_SUSPENDED) a signed host (RegAsm.exe, MSBuild.exe, rundll32.exe) -> NtUnmapViewOfSection -> VirtualAllocEx(RWX) -> WriteProcessMemory headers+sections -> SetThreadContext(EIP=entry) -> ResumeThread. Detection signature: NtUnmapViewOfSection -> VirtualAllocEx -> WriteProcessMemory chain, CREATE_SUSPENDED procs that go RWX before any window.
  • Thread hijacking: suspend a target thread, write DLL path, resume into LoadLibrary. Hooking surfaces: SSDT/IRP (kernel/DKOM), IAT/EAT (userland), inline (patch func prologue jmp).

Related techniques

  • [[reverse-engineering]] - static/dynamic RE, anti-debug/anti-VM, VBA maldocs, shellcode tooling