-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Learning Malware Analysis
By :

By now, you should have an understanding of how malware utilizes API functions to interact with the system. In this section, you will understand how malware makes use of various API functions to implement certain functionality. For information regarding where to find help about a particular API and how to read the API documentation, refer to section 3, Disassembling the Windows API, in Chapter 5, Disassembly Using IDA.
The simplest type of malware that you will encounter during malware analysis is a Downloader. A downloader is a program that downloads another malware component from the internet and executes it on the system. It does that by calling the UrlDownloadToFile()
API, which downloads the file onto the disk. Once downloaded, it then uses either ShellExecute()
, WinExec()
, or CreateProcess()
API calls to execute the downloaded component. Normally, you will find that downloaders are used as part of the exploit shellcode.
The following screenshot...
Change the font size
Change margin width
Change background colour