Questions tagged [malware-analysis]
The malware-analysis tag has no usage guidance.
25
questions
1
vote
0
answers
64
views
WordPress Site Hacked to redirect stripe.js offsite for credit card skimming - Can't Find The Source
We are experiencing an issue on our WordPress site running WooCommerce, for the second time this year where a hacker is injecting some kind of script that is redirecting the stripe.js code from it's ...
0
votes
1
answer
100
views
Why do sandboxes detect behaviour that isn't in the binary?
A case here: https://www.virustotal.com/gui/file/416b4499cd364f8d645e7bcd591ca4ac71ad1227e4a888c7f1d49e90445e07e2/behavior
You can get the file I uploaded here (POSTNTFS.EXE inside the zip file): ...
- 1,192
0
votes
0
answers
67
views
Confirm If Website Unsafe/Compromised
Neither are recent, but I've encountered two websites that are on benign subjects but appear to be compromised and/or have triggered/transient pop-ups or redirects that seem malicious.
I run websites ...
- 1
27
votes
4
answers
9k
views
How long does malware last "in the wild"?
I watched this YouTube video where the uploader connected a Windows 2000 virtual machine directly to the internet, no NAT or firewall.
Within minutes, his VM is infected with malware, the overwhelming ...
0
votes
3
answers
136
views
Network knowledge in malware analysis
I asked an experienced person about the needs of malware analysis. He told me:
"Learn x86, C/C++, Win32 API, Windows internals, PE file structure basics... Then when you are comfortable with ...
0
votes
0
answers
158
views
How to Safely Research a Suspected Malicious Website by Using A VM [duplicate]
I am aware of a website that I suspect is, at the very least, pulling user data from visitors and possibly performing other malicious activity on visitors. Of course, the safest course of action is to ...
0
votes
0
answers
27
views
How to analyze code files (Java, PHP, Python) for malicious code? [duplicate]
How can we analyze files like .jar or .php or .py files for malicious code?
I need to automate the analysis process using machine learning. What should be the features in these cases?
- 13
0
votes
1
answer
355
views
How to know if you have downloaded a malware on a virtual machine [duplicate]
First, I'm a complete beginner, my only experience in malware is running windows defender lol. But I will try my best to learn anything that you guys recommend.
My younger brother keeps downloading ...
0
votes
1
answer
441
views
OTX alienvault | API | Get new pulses of the last 24h
I would like to get the "pulses" of the last 24h from the Alienvault OTX API, as a free user.
I tried using /api/v1/pulses/subscribed with the modified_since: parameter. As the name suggests ...
0
votes
1
answer
4k
views
Volatility: AutoMagic Symbol Table error
I am trying to analyze the .vmem file from HoneyNet challenge 3: Banking Troubles (HoneyNet) using volatility3. But I can't seem to get past this error:
PS C:\Users\<user>\Desktop\HoneyNet\...
0
votes
1
answer
172
views
How to make VBA code stay hidden even after vba stomping?
I am experimenting with VBA stomping in microsoft word documents.
I have done it manually but also with the evilClippy tool aswell.
What i have noticed is that, although the original vba code stays ...
- 23
0
votes
0
answers
39
views
How to check if a Firefox add-on is malicious? [duplicate]
How to check if a Firefox add-on is malicious ?
I'm interested about this one currently : https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies/
It got a Github repo
- 1
0
votes
0
answers
24
views
Found several potentially malicious PHP files but not sure what they are doing? [duplicate]
A friend found several suspicious PHP files on his server when we was upgrading his Wordpress install. They are all in the public_html folder and the filenames are the name of his domain with ...
- 101
1
vote
0
answers
286
views
How do I go about analysing VirusTotal and Hatching Triage's memdumps?
I normally use volatility to analyse memory dumps, however, in this case it doesn't seem to be working. I get a "Symbol table not found" kind of error, even though I have downloaded and ...
- 33
1
vote
1
answer
127
views
Can I trust companies that test antimalware software? [closed]
Do they lie? I mean companies something like AV-TEST, AV-Comparatives, Virus Bulleting, ERG Effitas, etc.
- 11
-1
votes
1
answer
299
views
Can ransomware impact SSD drives?
I was watching this DefCon talking about Solid State Drives (SSDs) destroying forensic and data recovery jobs. It was interesting to note, that the speaker did acknowledge that it is unknown how long ...
- 713
0
votes
1
answer
618
views
How malware file signature is generated?
How is the malware file signature generated? Does it use a sequence of bytes in the beginning, size, PE (export, import, section), etc?
And can the MD5 or SHA256 be considered a file signature for a ...
- 113
0
votes
0
answers
133
views
Malware sinkhole evasion techniques
I have read into malware sink holing, as a way to disrupt botnets.
There are also approaches to make this more difficult, for example using a Domain Name Generator algorithm which is what the ...
- 211
3
votes
2
answers
1k
views
Has malware detected mitmproxy and similar tools used to intercept and analyze malicious traffic?
When trying to analyze malware, have there been cases where malware detected the use of mitmproxy and ceased operation?
If that has happened, would it be a good idea to be constantly using a proxy as ...
- 1,633
2
votes
0
answers
148
views
Opened compromised Excel file - am I safe?
Long story short, got duped into opening an XLSM in Excel, with macros being enabled. Realised instantly.
Digged into the Excel structure, found the following (extremely obfuscated) payload:
=CALL(&...
- 21
0
votes
1
answer
693
views
How to store malware for analysis?
I am planning on analysing some malware samples dynamically using a sandbox tool and a target Windows VM. The host (physical machine) runs Ubuntu and in it are the sandbox and target VM.
So far I only ...
- 1,155
1
vote
0
answers
280
views
What is the difference between malware signatures and malware artifacts?
I am trying to analyse some malware samples but I am trying to understand the differen between malware signatures and malware artifacts. As far as I understand (and from what I've understood from this ...
- 31
0
votes
1
answer
199
views
Malware dropper uses "^" character in syntax of cmd.exe before calling mshta.exe to download file?
I found a malicious Excel file that was using an embedded HTA program as its dropper to download a powershell program from a malicious IP. The dropper was on a hidden sheet in the file. After ...
- 1
1
vote
0
answers
902
views
Security of Third Party Plugins in Thunderbird
In Thunderbird (a popular open source email client), there is an extension store similar to Mozilla Firefox which adds further functionality to the client. Mozilla has an article detailing the ...
- 77
1
vote
0
answers
114
views
Pixel File Size in STAMINA [closed]
Last year Intel released a white paper on a joint research effort with Microsoft concerning the possibility to perform malware analysis by converting a file to an image and then applying a deep neural ...
- 413