I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was in an executable called mom.exe (from Windows), the other was in com.apple.WebKit (from OSX). Can y'all think of ANY legitimate reason I should be seeing results like this?

I'm pretty new to this process, so I'd be grateful for y'all's insights.

Thanks in advance!

  • So your problem is that the injected code were full functions, with prologues and epilogs? Why should that be a problem? Most likely, the injector copied a full function of code.
    – Ángel
    May 21, 2015 at 21:55
  • Thank you. Read here:[link]books.google.com/… regarding the carberp memory sample and also the second bit about coreflood. Basically he's saying that you should not see prologues and epilogues in malfind results unless I'm completely misreading. May 21, 2015 at 22:10
  • Basically I'm concerned that the artifacts in question are indicating a compromise and I'm just confirming that it likely isn't anything else. May 21, 2015 at 22:14
  • No, the book doesn't say that. Summarised quote: «This region is worth further investigation because the disassembly make sense. Eg. the JMP destinations are valid, and (...) indicates the start of a function prologue.» Then it shows another example which does not make sense (it's not really code) and mentions the ENTER with no LEAVE as a hint (although I would focus on the invalid addresses instead)
    – Ángel
    May 21, 2015 at 23:25
  • I don't have enough info to determine if they are really a compromise or not. Are they images of real (supposedly clean) machines or exercise ones?
    – Ángel
    May 21, 2015 at 23:27


You must log in to answer this question.

Browse other questions tagged .