▶Book Description
Malware analysis and memory forensics are powerful analysis and investigation techniques used in reverse engineering, digital forensics, and incident response. With adversaries becoming sophisticated and carrying out advanced malware attacks on critical infrastructures, data centers, and private and public organizations, detecting, responding to, and investigating such intrusions is critical to information security professionals. Malware analysis and memory forensics have become must-have skills to fight advanced malware, targeted attacks, and security breaches.
This book teaches you the concepts, techniques, and tools to understand the behavior and characteristics of malware through malware analysis. It also teaches you techniques to investigate and hunt malware using memory forensics.
This book introduces you to the basics of malware analysis, and then gradually progresses into the more advanced concepts of code analysis and memory forensics. It uses real-world malware samples, infected memory images, and visual diagrams to help you gain a better understanding of the subject and to equip you with the skills required to analyze, investigate, and respond to malware-related incidents.
▶What You Will Learn
⦁ Create a safe and isolated lab environment for malware analysis
⦁ Extract the metadata associated with malware
⦁ Determine malware's interaction with the system
⦁ Perform code analysis using IDA Pro and x64dbg
⦁ Reverse-engineer various malware functionalities
⦁ Reverse engineer and decode common encoding/encryption algorithms
⦁ Perform different code injection and hooking techniques
⦁ Investigate and hunt malware using memory forensics
▶Key Features
⦁ Explore the key concepts of malware analysis and memory forensics using real-world examples
⦁ Learn the art of detecting, analyzing, and investigating malware threats
⦁ Understand adversary tactics and techniques
▶Who This Book Is For
This book is for incident responders, cyber-security investigators, system administrators, malware analyst, forensic practitioners, student, or curious security professionals interested in learning malware analysis and memory forensics. Knowledge of programming languages such as C and Python is helpful but is not mandatory. If you have written few lines of code and have a basic understanding of programming concepts, you’ll be able to get most out of this book.
▶What this book covers
⦁ Chapter 1, Introduction to Malware Analysis, introduces readers to the concept of malware analysis, types of malware analysis, and setting up an isolated malware analysis lab environment.
⦁ Chapter 2, Static Analysis, teaches the tools and techniques to extract metadata information from the malicious binary. It shows you how to compare and classify malware samples. You'll learn how to determine various aspects of the binary without executing it.
⦁ Chapter 3, Dynamic Analysis, teaches the tools and techniques to determine the behavior of the malware and its interaction with the system. You'll learn how to obtain the network and host-based indicators associated with the malware.
⦁ Chapter 4, Assembly Language and Disassembly Primer, gives a basic understanding of assembly language and teaches the necessary skills required to perform code analysis.
⦁ Chapter 5, Disassembly Using IDA, covers the features of IDA Pro Disassembler, and you will learn how to use IDA Pro to perform static code analysis (Disassembly ).
⦁ Chapter 6, Debugging Malicious Binaries, teaches the technique of debugging a binary using x64dbg and IDA Pro debugger. You will learn how to use a debugger to control the execution of a program and to manipulate a program's behavior.
⦁ Chapter 7, Malware Functionalities and Persistence, describes various functionalities of malware using reverse engineering. It also covers various persistence methods used by the malicious programs.
⦁ Chapter 8, Code Injection and Hooking, teaches common code injection techniques used by the malicious programs to execute malicious code within the context of a legitimate process. It also describes the hooking techniques used by the malware to redirect control to the malicious code to monitor, block, or filter an API's output. You will learn how to analyze malicious programs that use code injection and hooking techniques.
⦁ Chapter 9, Malware Obfuscation Techniques, covers encoding, encryption, and packing techniques used by the malicious programs to conceal and hide information. It teaches different strategies to decode/decrypt the data and unpack the malicious binary.
⦁ Chapter 10, Hunting Malware Using Memory Forensics, teaches techniques to detect malicious components using memory forensics. You will learn various Volatility plugins to detect and identify forensic artifacts in memory.
⦁ Chapter 11, Detecting Advanced Malware Using Memory Forensics, teaches the stealth techniques used by advanced malware to hide from forensic tools. You will learn to investigate and detect user mode and kernel mode rootkit components.
