Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
- 14h 29m
- Andrew Honig, Michael Sikorski
- No Starch Press
- 2012
Malware analysis is big business, and attacks can cost a company dearly. When malware breaches your defenses, you need to act quickly to cure current infections and prevent future ones from occurring.
For those who want to stay ahead of the latest malware, Practical Malware Analysis will teach you the tools and techniques used by professional analysts. With this book as your guide, you'll be able to safely analyze, debug, and disassemble any malicious software that comes your way.
You'll learn how to:
- Set up a safe virtual environment to analyze malware
- Quickly extract network signatures and host-based indicators
- Use key analysis tools like IDA Pro, OllyDbg, and WinDbg
- Overcome malware tricks like obfuscation, anti-disassembly, anti-debugging, and anti-virtual machine techniques
- Use your newfound knowledge of Windows internals for malware analysis
- Develop a methodology for unpacking malware and get practical experience with five of the most popular packers
- Analyze special cases of malware with shellcode, C++, and 64-bit code
Hands-on labs throughout the book challenge you to practice and synthesize your skills as you dissect real malware samples, and pages of detailed dissections offer an over-the-shoulder look at how the pros do it. You'll learn how to crack open malware to see how it really works, determine what damage it has done, thoroughly clean your network, and ensure that the malware never comes back.
Malware analysis is a cat-and-mouse game with rules that are constantly changing, so make sure you have the fundamentals. Whether you're tasked with securing one network or a thousand networks, or you're making a living as a malware analyst, you'll find what you need to succeed in Practical Malware Analysis.
About the Authors
Michael Sikorski is a Principal Consultant at Mandiant. He provides specialized research and development security solutions to the company's federal client base, reverse engineers malicious software discovered by incident responders, and has helped create a series of courses in malware analysis (from Beginner to Advanced). He has taught these courses to a variety of audiences including the FBI, the National Security Agency (NSA), and BlackHat. A former member of MIT's Lincoln Laboratory and the NSA, he holds a Top Secret security clearance.
Andrew Honig is an Information Assurance Expert for the Department of Defense. He teaches courses on software analysis, reverse engineering, and Windows system programming. Andy is publicly credited with several zero-day exploits in VMware's virtualization products.
In this Book
-
Practical Malware Analysis—The Hands-On Guide to Dissecting Malicious Software
-
Malware Analysis Primer
-
Basic Static Techniques
-
Malware Analysis in Virtual Machines
-
Basic Dynamic Analysis
-
A Crash Course in x86 Disassembly
-
IDA Pro
-
Recognizing C Code Constructs in Assembly
-
Analyzing Malicious Windows Programs
-
Debugging
-
OllyDbg
-
Kernel Debugging with WinDbg
-
Malware Behavior
-
Covert Malware Launching
-
Data Encoding
-
Malware-Focused Network Signatures
-
Anti-Disassembly
-
Anti-Debugging
-
Anti-Virtual Machine Techniques
-
Packers and Unpacking
-
Shellcode Analysis
-
C++ Analysis
-
64-Bit Malware
