Malware Analyst's Cookbook and DVD by Michael Ligh -- Read -- Imperial Library of Trantor

Index

Cover Title Page Copyright Dedication About the Authors Acknowledgments Introduction

Who Should Read This Book How This Book Is Organized Setting Up Your Environment Conventions

On The Book’s DVD Chapter 1: Anonymizing Your Activities

The Onion Router (Tor) Malware Research with Tor Tor Pitfalls Proxy Servers and Protocols Web-Based Anonymizers Alternate Ways to Stay Anonymous Cellular Internet Connections Virtual Private Networks Being Unique and Not Getting Busted

Chapter 2: Honeypots

Nepenthes Honeypots Working with Dionaea Honeypots

Chapter 3: Malware Classification

Classification with ClamAV Classification with YARA Putting It All Together

Chapter 4: Sandboxes and Multi-AV Scanners

Public Antivirus Scanners Multi-Antivirus Scanner Comparison Public Sandbox Analysis

Chapter 5: Researching Domains and IP Addresses

Researching Suspicious Domains Researching IP Addresses Researching with Passive DNS and Other Tools Fast Flux Domains Geo-Mapping IP Addresses

Chapter 6: Documents, Shellcode, and URLs

Analyzing JavaScript Analyzing PDF Documents Analyzing Malicious Office Documents Analyzing Network Traffic

Chapter 7: Malware Labs

Networking Physical Targets

Chapter 8: Automation

The Analysis Cycle Automation with Python Adding Analysis Modules Miscellaneous Systems

Chapter 9: Dynamic Analysis

API Monitoring/Hooking Data Preservation

Chapter 10: Malware Forensics

The Sleuth Kit (TSK) Forensic/Incident Response Grab Bag Registry Analysis

Chapter 11: Debugging Malware

Working with Debuggers Immunity Debugger’s Python API WinAppDbg Python Debugger

Chapter 12: De-obfuscation

Decoding Common Algorithms Decryption Unpacking Malware Unpacking Resources Debugger Scripting

Chapter 13: Working with DLLs Chapter 14: Kernel Debugging

Remote Kernel Debugging Local Kernel Debugging Software Requirements

Chapter 15: Memory Forensics with Volatility

Memory Acquisition Preparing a Volatility Install

Chapter 16: Memory Forensics: Code Injection and Extraction

Investigating DLLs Code Injection and the VAD Reconstructing Binaries

Chapter 17: Memory Forensics: Rootkits Chapter 18: Memory Forensics: Network and Registry

Registry Analysis

Index Wiley Publishing, Inc. End-User License Agreement