Anatomy Of Malware

[Loki]

Here is a paper I found on milw0rm which goes into reversing a piece of malware. Nothing all that revolutionary, but a decent read for those with a few minutes to spare

This tutorial should help people understand how a simple piece of malware works. I might

eventually go on with a series of papers that should help beginners in reverse engineering to

cope with malicious programs.

This first paper is about a password stealer. To start with something simple, it's a dropper

program written in C, packed with FSG. The code is quite clear and understandable. Many

common techniques used by malware in general are used in this very program, which makes

it an even more educative piece of malware to look at. For educational purposes, most of the

analysis will consist of a white box approach - in our case, meaning stepping through the

program and analyzing it with a disassembler.

/>http://www.milw0rm.com/papers/133