1

I have a malware sample. I want to know what vulnerabilities does it exploit (and of which software). I tried analyzing it in IDA Free and it seems that the code was developed in Visual C/C++ runtime. I know that C/C++ code is hard to decompile. Can anyone tell me how do I find what vulnerabilities does the malware exploit without having to decompile the malware? I don't need an exact methodology. Even pointers to think would be helpful. Thanks.

closed as too broad by user10211, Xander, TildalWave, tylerl, NULLZ Sep 7 '13 at 1:19

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Stuxnet holds the world's record for number of attack vectors in one piece of malware. 4 Windows zero-days, jumping air gaps, infecting ladder-logic programmable logic controllers and then deceiving the operators by intercepting the reading that were coming out to the control room, the works. – SDsolar May 16 '17 at 4:21
2

There are two sort of malware analysis dynamic and static each has its own pros and cons. As you are trying to reverse engineer the malicious code you may require adequate machine language knowledge to analyze the code and identifying different routines. The second way is go with dynamic analysis by executing the code in the sandbox environment. There are few open source automated malware analysis tools like cukoo that can identify the threat data the malware is trying to exploit

  • Thanks a ton! I knew about static analysis but not about Cukoo. Installing now. :) – TheRookierLearner Sep 6 '13 at 20:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.