Discover millions of ebooks, audiobooks, and so much more with a free trial

Only $11.99/month after trial. Cancel anytime.

Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
Ebook1,511 pages7 hours

Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

Rating: 0 out of 5 stars

()

Read preview

About this ebook

A computer forensics "how-to" for fighting malicious code and analyzing incidents

With our ever-increasing reliance on computers comes an ever-growing risk of malware. Security professionals will find plenty of solutions in this book to the problems posed by viruses, Trojan horses, worms, spyware, rootkits, adware, and other invasive software. Written by well-known malware experts, this guide reveals solutions to numerous problems and includes a DVD of custom programs and tools that illustrate the concepts, enhancing your skills.

  • Security professionals face a constant battle against malicious software; this practical manual will improve your analytical capabilities and provide dozens of valuable and innovative solutions
  • Covers classifying malware, packing and unpacking, dynamic malware analysis, decoding and decrypting, rootkit detection, memory forensics, open source malware research, and much more
  • Includes generous amounts of source code in C, Python, and Perl to extend your favorite tools or build new ones, and custom programs on the DVD to demonstrate the solutions

Malware Analyst's Cookbook is indispensible to IT security administrators, incident responders, forensic analysts, and malware researchers.

LanguageEnglish
PublisherWiley
Release dateOct 1, 2010
ISBN9781118008294
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

Related to Malware Analyst's Cookbook and DVD

Related ebooks

Security For You

View More

Related articles

Reviews for Malware Analyst's Cookbook and DVD

Rating: 0 out of 5 stars
0 ratings

0 ratings0 reviews

What did you think?

Tap to rate

Review must be at least 10 words

    Book preview

    Malware Analyst's Cookbook and DVD - Michael Ligh

    cGdbook_preview_excerpt.html}Ys#u_I 7)V+jECԖ dHU" Aye~¼0)K|gf*Yq(,W@.w9;˸&k4g{/^*褈u^Ge~LE}}vݔe^7d^dߵiM*zMV"zN6w'iOlyV$wY#nDdd?x0:ʺ^YD6Oo*+.$xYtÇ_V /M}?B;- Dky٢͛Hi:ʊ蔮Kܕ^GO?<>:8?o|0<8 G;=9|:|ыE^E;'M[i<YC]7qCZNEZeH4z=EQtohW jY-."ZhFUʤ R_MQMt."z5^TAd\t JtTeMdӧ8Dyٔf*UI\SzTIVYs&鲉byZ"I^@Ǹ`2>~[5OY'ff^Mfxߴ2zʪ; y[]cFQo[z@}/+̫i׋hxI+KϥC;iԔiƴ;NWeIGni16hu_DOnɃA4G <EW)ASkLA3iM4'I5㮪$_BOċϢ벨f5U/q>-_Fh;ti с?/<+h`MD d4㽽ٛ{~.(+/3",gy֬βz$|.h51R[ 0TIn:1Ө(Ȥ5-@,$‘'dDk .^œI[œ5..󔨌VHeRҶMꪬ1W:IrcBӬ7cc٤cZō"bzژĤJc''&"18OyD/#v+sffD<M:@0v4hLQQ6xY$ 1Ĕ^5-Oϴ%,/8V9CM̞W4;eVa..8T 3%E4e;L+̈w1Koe*awa b@}p95JC[r*7B +%JA՘%V{J%{Q#fĦ1-NeVJBkL~O2,VV)dDܐĆ0Oٟ/UYt >6Kp ˜1D.1\=!bRY !^Eici- :o١KBx=OڬR5y޶%5)3? yaq3!-r_-IF4CG}Zx$ O1KlmChv<~Llt\ڦ*o.~px9ᨫ )cZo- YJHk,kU%q^yrф,' <2Wqů<-D$>еy]jӣ#yhiWc&V䯼PuS0̵SuXvM2aW Ll*G8<$T%]+{DgER rEKk{Xj9X0TEeTi8ƹ}<]|qSF ҾEJ0_#\9Ϧ"z?I5n [l]G$*&]1Ԕx=8W4^$uE2"]1ej# %)ae8u\oUh,pk?/qp5d})xu ":IbQk_x2hf]j2y6V$P٫j|B͈+X*`& e-ѝߧ|h^.e`!.%$wa$Z/!4f1 I˩Y).}5'&v5=̠ٴ,*qH3ǷnڄU=UV~IiVbg6e l,Im~iɟNG24o :NIER"4X[` 6e6a'+&&;yEfkrE y3`YT⠟j-Ipf=a&GBј^8#P FO:$.]Y]jf,Y5O P\Itc-d)5n)jbXCfuZi'5@؅b3G ֚H'6oNY:ł] }FUsz}l[a/^1MZ&C\VZ0FUikH?>8/"%ʎd]75uN~&b+E_ꮳx"yg8Pe|P 08b0-⾞ j|JOJDN*i6}y"9yϦ"ٝsjQ 뽸6S"0ٓl%y)-4-1ZzmԵxL0^lUbv5 b6.6fi~OїmF% 1H JgEz7$^(HiXl\w낌 ]+ƺ #ds=tF|,yFcjF;RBLBSOOwWXg"SEY%mK`ʪb${5N;Y<+D25}Ug`0y2 8/g;&OKuuxIf^fK D(& .bGae mٰ%跠&Ҝ8vA[N,S9,G @D hEx)YH#5^/2N I;벥QWY,1L$v`%clMږAwXMxQ(WGD)|8J26{'"]W'tKN4<"m^ X3W-GY18HӨXO/=Z ܒ3H V,Ob(2kpf6л{R#OB Dc5ȈdQ@6jE4?;?Dd qeZmW[NV?SdJaH6]GeD\ʉ4'd tq>:οkK Uz9ÑGp_\Gug8!3{oC\u_77FˈN&ߖ[򀧋G.n6%DžM[V6q@]D_94 xbLw` . 18b<;Bb/XJPJ82Q울~/D#F$I-!{N;&X;+Hnu.ASZ!( ct QJS6J[8}@$RA vE ) %h&N|aoA2+;u+%q'VUs;# XLC8KV ajƗR{vj67ײW8ʜi\r.WCwry: #z^rLvn a$DŽb"*FqBtqb _ ȴKRXѭ~vWtT7DP7&v__A ANՍXDͰt}_2 ҈$.@827S~O)iUmOt-2c֭OZߥEyVKs L*VբYڜ.n踤y-dQYu.;m-nf-F,z ٿۙ (/荜4Kބbt g3pN ̙@DRΠ>֟(߱asbm2=N3T&# [Ad=)i#,βzReHB\PEjjVK]X֕RLO^{]!'RDiII2C9D܊8Y=̜WbJiiҩ(6ZHK0yFf) :!u~"jP+-@ Y|)RgKkknʉOb𹛶D^Ueo #SaA-X^7.TBmxut=aӽt{ >U9:eKBZ\AܷW,%iO\JJɥL5E}Xcأ) 9"*Ӫ8\Viĕ%q#֋^̏KGrIO6P~ދD Pƴ+nqb.`!IMAKan';@Ygu):f(I- Mj|s-'KT;=5 vB c)<,KWޝlo# h'Blyp^%aS%4X:v6fDgoS<8K0=i'^ӎ;lѺ YeNtԦeL>NH:=eFg0ְ.Z)QN>S 2*!ȹ6lVVT6;rϝ`D*̅t:-\W6y?.qLǵZ K9ʲyoL;@9!]O(IYioA9p%/,jKR䑌ɷVD0>vL&ux]ͫ_kGCt))*}uNٕ51MŃgrg EVQdKfayW 7IC(X6nh˼ 3^mAwgO.QxiV.Ǝ?f+Nn!VtXm= NR坜zMO=Ke9cӨz'cWqa'K ܚX&&ED}, ݈z0Avr.͆ ȳfLBh[X4ʤqU(?.96NɆY>Z%;x}D.UMLpTxEV^`z5P8OG9 cw]Jv^aʜP5rx߲d}$L8Wl%a ,X G kzk=1HKv9hl!ük.w7ؔ{Uji=ƳPORe$`笚g'(X`rM+K+_|]$0{Jm<U{QɼDU_xBKI[5 O Ef6I B.=As]8D3sϾzJ9ߖzVǒ|ёb|;,l촅R cX"]^̃K#e*~aU(}H=zQ0,Bxg{|\Ȧve.Nnvqؾ 4\SC+]=],77񶍸Rk + B$-NӸzM9`@(ndnDospմI@_A(!E3idi%6tQ,I\aX7 `\+M7ͩ`h%a"N ڤx8DBiБMb4wW X,TpRldDk]9bV\Z^qώ) K] K  RҠ`%JK͔]X}#k~ᘎ}K| bPxTN%묆nL|5.`nT._b8lc`.0ĝ%:w75eGz6QB ά!{@ 07i:62 8xjrpQ.&/q+ea x)y2٣hޝ}EL6oFzy§t?%q>V\wCCy2|ImyfirӰGZRrBLuhh# Dj$ }x^!J] c w h\v]z(MgD4JB dYMi[p e\GXs*AVҘFwDtmSӤ)IC؎g蝛ʹVV[n^m1Sijd(sME'ЋaH9tA(`D4 h<#܂5;/Cx9̩YMBa&$6I ZYgI=ɗ:+ϲ&\ߢn[I|H̝-X:@ƺY "%SPTw #gF:I!XO;C:^G fQIӰ=?t5Q_.}ML\寚*1RU{~Zy;)VrGD=Sgs {r5KBj1١ug#\=&x3.|U~Cx,.*43QO^_GoةQ7:4&A Av8cgtdΦP%;F3}z V(FʪbLS%14=IcyQ[u$lV0sBD59HikE\NrcrY00HPl>")HŔQ  &Rs-Ig6}^ܹ7?yppw(\LM-ȐJ2+=+d9ajH? 00a*8HxʜMÿmNffl@Xi#pvVg EW8zY@Ybg vGdXґL+uGe $<:A]YVNo%-1|%:RS'qtTO<$i)KXj1-Q|<6j'wi_`++A,yCZDxAPnc(Ô:HA(*}`ܲ푤b$qi+ B+@K&(@Ɉ4X3:&7nO"isJpȧ| >_dYfL8drn)Fk%& gg/en } ۚS1eqdȣj!9 d;[4 {>q$4CF=p%8 'eՁu~v#ON7g\珙|o,H[du\R)jw,#Qm%&JS×Vtk0UCp\4 AJDAPZ!Lh*"Z1rCFȄ:2.+O3ٗz#l?rDG—/o >o7tA|^cV7`śY/`I.WTm Ig@ѩ_ᖷh`wA07e&B\")5rV) t߷V:S7tN9Q,f"hݪU1`F5$}k7D&R v֢B*cR ۙ@P/v%ƮUsM4j4yĢ H{Tf01;[Yg +e™?2_8(Rh֍COw(2N( ̘Tso6%p}́NF+mXʹ60* ;Ί6MeU*AхY3v%1ڬRa K,.!UvOAJ8b ~=_ TT=i cwZءj):8)$k\&%z9\dLK\DM_9%;*DZ6.IW[;V RH[5-7)\}̌x.bLC 0T;y<#6!Ro:QG4[Ai :z Z5!,2~讯 7a(ed.G: KPLSy$?s(o'0&itJ ]\$mn dJ"qV8'yQqNȜ!$l}4C%9a%| l uJ] 06IVbK3v4Q$cT36,,li4sw\$vA5Ɍ`ɉFrIE& `fB |˱j'`"{0)Z6[TmXXDq( iw,\zt`7 wtl c]4 {9=Yc.,wI>=sPLP-Q+t1.ɗv/q ;bָ{bLyLfU A7] 6YykQN x y54.nL|x%g,r)*\H\ؖr0 ǣtU Wk>T*Kf ۥ!y 9T-CX'06I f GMpw"p]W.JG[ ip7o*d禬vQ{N"d r~miQ-"l=QiR2~=%o.,2"&;˔']$C id#3'> *ؒDp3֝7Rd)+~ў*dY 0kz]m@ڜ7bgf;5)*W&ΊU)aŬ"t1Jq$c{.b@Gfq+ő(8=> )jp4v Qˀ7_pJ$};:aJ+DL[3nB!YnbIk" z?G5JS!y^Y-fbڂ7- qVYL Z۸`qo4.ymnoTĩR 1t >&K] rlzw~+-3(^+dյ)цS7~V%)FWwk5yG$dq=(q X\2pʀF y@"-<Yi,2paY[+(*+Q=}G|[s;@51ҝD ]Hb0cw_\x Ė^y])s8N#1=-iHIvA f&/4Oq:T6-&#0:] ~s?={ YT5lce;Gˈk?$JBn[ZzQ@̑:,rkN1$U߂Ttms.5k~a<wqJKk6޹8 y`ƆȘ)x3")7776/Ou/O^[J|BnBt%\~c]<⺀И?`ڕﺄ_!*=,J (\ GmګSQLj)(Џ/` G>{A?IHux1:G[h0 i#4i'Lqץw?'ֽ_K++,׆ AF;A fD44qB*,s:ҭ&є4R86Tl9!SRzzS/^Q o;e7P&,IB%}%iW}2O50`y?a9O'!Q6o@31 :uk5l8Pe5mnюi_q̳e)46.* iڀhsXbX$TO$Κ;ZϤj jȨlSI ݵaT88A|C-39:ذWX81d3dvKz=4;v4o(-^HՋ{byB1|{ z\wxHOmZW_ [^'9p.r )Yq#Qnu#]mBr۫i*dSXF[XS2~1\WsYоV+5A*^'0Pieoi׈lw4Dv˼i%"puxmskQ+u'TP͈_nY]ۼF~ru(q>@Vz ~~)3Rӏ2\L܉Y7=yQ`#4MnliR;iPHÍ Xg--% ϭ?K=rHqV ;ɲcvN|ŗZ@`r`Gϟ}-88tk1sB;9thw։5AwTߙ3#W|~ o& j?7UE%h+3 KqלX$Zfkg*ީ[lq|Mi5xo$xnD$[6b4np.Vh!I\`Fu3m + LJIXZ67ch^)ˈ÷.^qpQbgW>Nޗ|wjս|]%LbS}GBǎ)a0Si-ˈj|n@]E1hZ3[QKHznR߬n ?t/TP(c:h#迕>@G˩7K]Kz虠L,C  lC37A"эO=x:-&:'\]qyYlRC_H -o=t2/YD'TV'*J2%kHe0zL\xDُM+;ܑXWhJܹ~R$ToyH?^D/T\Fwd(w̡XMcPis*f @9d89RD/{ 7G{nRM[GxCMwÆӜ-J5S^jاտz}%~P'\:ں˳utoYTf}Ew͚WCvjFIU;R" ť6taa DT@u=G"|1\Ear{ߣ8:=\|7KYsna97Ρ]ݘeP;۱7಑fUP=6ny\rWMЖ&w\շW_sp ]~s9e`RP˷<@p]?ٵ(*uAcsSvnR~/;:a0Jih:X !ϡt:Id47&δH=#Ys ^XYլwDnIF\Ƴ*)rM [$*=ߑo/ooo>a|t (gȔֿtd3j'_x[%qKRG嫯%|V$暝rGOx݈_l,AZr:_ȥ22(4+S8+CZ< KUN`;̠ *5Ґ-}{9f_f.x7#ā`5ڲfԇ$aKVthsKZCůpW3cT.%Դ.r,=ߝ?43}XmQi=) 6xoPG_\\D͠*v#E*y ep?t(4ry4kWΤAa,̫4χRS3 ֖H#s Ѳ-&T2BYÝW:?2pN.Es1 o%@z l9)"J5I!|9jϸi#7 Md5ʔZH|SEmB2R 8v lo*}Q;Vujҁ%,pE $VGoomARȚ̒ƌd6;Y(I&=Do8ɀ`(W+^@ɢR%jEs#|; MZ^ϚO.ɮRW*@Nc"0HɎwAI~)I֌\!\$u"-=JhqEkȫ@:!R޴i!<5܄W!m'6iZ%صZ#^=Ҧ; f.`ID.HL"ms4P\ \$r9kHrx_t}7v:'ApIUXBG ݪ;Zjvh}3C7RupB$2 itXy:#Ɇ [T<;#zi7i( 3LKM5GV)#l`Ko 'SH¸m*v*,WB*}/Y%[ڏ3E#BBZ0 ج )bK^ ]S4Jo K%v&5eM }l,es+Mjj$64qŅvM |;pӤe.;wղf1=!VhDofhb_k-8]䰯[nngd=+8-$ v2`Lz8} {;-Af1 pj^ipv&fYsE$rb?<e*`Y]uஐZB?+v)g;3 7U } eB9ꘁo В"SY4KX@!؞pSJw^[=@{8jpRp ^P(륨5-+>ME \(~4\U8]AvF8 eç 6=&$kb%fV٥Rn<'H:A@A5)qDR/CUCoQ Yʻq )L9pV:Wy;ً;Z-8bd_dmA`|Vjϙ O2 TbE7Ɩ1l Cw\=Ad(n(wk [O߼~}~zco|u1dSuOV+lk*}C0NxH#(dAtilԭ%X>ZO͊/M6JV^cr򸤸Aa':XF&V <ҶjcV_@ǽ{ݾz`rcnb^nƥƮKxX=;0YE,͑+9 iAPUGr@`gx›^x z^ q9ΘuyIi>!qYk>`9\u;>BQ!+ֹjJ*wLoܻVfkj쁡'U5:=KKe-g{zpšpѤACHQ.f˻yda$q@dSv3 U3A^R -ւ%fKv:n:N5Si_;^w#_>.bVOMD6Ppښ#`;OqÐ4{yjPaN眈dNޣvˬ ׵DpƲk>C'hvE:3vږ?!? <}+è DLh~[e}5 ן]7߾:y3,]a+LOȌ|۫?;^^ys{>W_l\L &"ԗIhS7 Sd<?0Stm͊YZ†'ggW,4+!-9F]!~ \8 ?]}\!X6>u /mB&Ѩ .дf9p i[biy\^\>y`6~ @I ]a^pȾpL0mf&ntc rB3U~hppDMh-QY(I Ѡ-N:x&M}t^7EuCUQu@aMfot~Bw3Q[Ŋb1IlRB?bdrS}rYPtL F)9dV.:>yAb-R\ v!ptzW]'>͎&>gUqg6EJdWԹ@Z'Dq\TOYlRvLrL(xT-oN=WV&hC({n34lՎFoQ< }"4e2`FsXєMW+;{[?1BPTjBŷ8stqMUәXVH' r l$+'ba9$4$Tp_PL6]<^YfY}!&{:_\jzaG<V^*fgrI_+39i~:Ӭa-[ /"qHQq!(ff4n3̒Zko!wϵGx^H"(p؁  2ܒí\\[+޸{'%:; h7j]f{vMKy [b]Gy9qB.~HP~Gt:.*怊rR&-4'KaO.$À.?A ylҊ5WSD4ve 9P a<N7N,і%kWHì4Ý^4Ȼ]c8uL$»
    Enjoying the preview?
    Page 1 of 1