Reading Time: 1 minute

A workshop titled Strategies for Developing FUD Malware was conducted during Infoweb days at UBI on March 21th, 2019.

First, I would like to thank all the participants who remained motivated and interested for 3.30 hours — well done!

This workshop focuses on several topics related to malware analysis, namely:

  • Understanding what is a malware and as it can be classified;
  • Windows Internals 101 (ring0, ring3, SSDT, DKOM, Windows process management linked list, Win API, Native API, memory, etc);
  • PE Fie Structure (sections, PE Header, IAT, entropy)
  • Malware: Sandbox analysis vs manual analysis
  • Malware protection 101: Packers, Crypters and Protectors
  • 0X042 UPX Packer – How to Unpack UPX
  • 0X043 Creating a Simple XOR Crypter (a section crypter)
  • Understanding how a crypter can be FUD

 

Direitos de imagem (c) InfoWeb – UBI

 

At the end of the workshop, it was intended that participants understand the following:

– Today, criminals are using novel techniques to bypass AV detecions
– Manual debugging must be used to unpack malware (a hard work that is needed to reveal the original malware code)
– Dissecting malware allows us to understand criminals’ modus operandi
– Manual analysis is always required to reveal FUD malware

 

Presentation slides are available below. Have a nice study and any doubt, please find me.

Once again, thanks.