malware-analysis-detection-engineering's Introduction

Apress Source Code

This repository accompanies Malware Analysis and Detection Engineering by Abhijit Mohanta and Anoop Saldanha (Apress, 2020).

Download the files as a zip using the green button, or clone the repository to your machine using Git.

How to Download Malware Samples(IMPORTANT)

The book contains exercises that involve both simulated and real world malware samples. For exercises which are simulated malwares we have provided the full sample in the above zip. For exercises which are real world malwares, we have instead provided the hashes of the malware samples. The malwares from these hashes are available for free download on https://any.run and https://virusshare.com and you can download the samples from these websites for free using the hashes.

NOTE: You would need to create a free account on https://any.run and https://virusshare.com by registering with your email id in order to download the samples. You can register in https://any.run using following link https://app.any.run/#register. Instructions to join virusshare.com is available on the following link : https://virusshare.com/about.

NOTE: If you are having trouble obtaining the malware samples, please reach out to the authors - Abhijit Mohanta/Anoop Saldanha, through their emails - abhijit.mohanta.15.08[at]gmail[dot]com/anoopsaldanha[at]gmail[dot]com.

Book Website

http://www.malware-analysis-and-detection-engineering.com More details about the book, including information about the malware samples is available here. Any updates regarding the book would be provided on the website.

Contact Authors

For any queries reagrding the book, or if you are having trouble obtaining the malware samples, please reach out to the authors - Abhijit Mohanta/Anoop Saldanha, through their emails - abhijit.mohanta.15.08[at]gmail[dot]com/anoopsaldanha[at]gmail[dot]com.

APIMiner tool

The APIMiner tool developed by the authors can be downloaded from https://github.com/poona/APIMiner. Updates and any other information about the tool would be provided on the book website http://www.malware-analysis-and-detection-engineering.com.

Releases

Release v1.0 corresponds to the code in the published book, without corrections or updates.

Contributions

See the file Contributing.md for more information on how you can contribute to this repository.

malware-analysis-detection-engineering's People

Contributors

Stargazers

Watchers

malware-analysis-detection-engineering's Issues

Samples 10-5 and 10-7 seem not to be working properly

Hi Guys,

Thank you for this awesome book!

I read all chapter through to chapter 10. All the samples worked wonderfully. But I had a few issues with sample 10-5 and 10-7.

Both of them doesn't seem able to inject the DLL provided. They manage to find the DLL but for some reason don't create the Thread.

Is there anything I can do to find out how to fix this issue?

I tried using diferent path and switching from foward slash do backward slash. Also provided different kinds of permission to the binary. But it didn't seem to work.

I'm open to provide whatever information needed.

I'm running currently my lab in a Windows10 machine with all AV features disabled. FlareVM has been run there also.

apress / malware-analysis-detection-engineering Goto Github PK