An In-Depth Analysis of the Bagle Virus

[Nytro]

Reverse Code Engineering: An In-Depth Analysis of the Bagle Virus

Author: Konstantin Rozinov

1. INTRODUCTION.......................................................................................................................3
2. BASIC X86 CONCEPTS................................................................................................................3
2.1. REGISTERS......................................................................................................................4
2.2. ASSEMBLY.......................................................................................................................5
2.3. RUNTIME DATA STRUCTURES..................................................................................................7
2.4. THE STACK......................................................................................................................9
3. VIRUS OVERVIEW...................................................................................................................12
3.1. VIRUS HISTORY...............................................................................................................12
3.2. VIRUS TYPES..................................................................................................................12
4. BAGLE VIRUS DISASSEMBLY.......................................................................................................13
4.1. OVERVIEW.....................................................................................................................13
4.2. ANALYSIS RESOURCES.......................................................................................................14
4.3. DISASSEMBLY APPROACH....................................................................................................16
4.4. ANALYSIS PROBLEMS AND SOLUTIONS.....................................................................................19
4.5. FUNCTIONAL FLOW...........................................................................................................22
5. CONCLUSIONS......................................................................................................................26
APPENDIX A: DETAILED DISASSEMBLY OF BAGLE VIRUS.............................................................................29
APPENDIX B: SOURCE CODE LISTING OF BAGLE VIRUS...............................................................................72

Download:

http://www.binary-auditing.com/downloads/011%20-%20malware%20analysis/3%20Bagle%20A%20Virus/bagle_analysis_v.1.0.pdf

[N008Cy807]

10X Nytro. Si daca imi permiti o recomandare, cred ca ar fi o idee buna sa postezi la sectiunea tutoriale si link-ul asta: Index of /downloads

Contine:

001 - c++ fundamentals/

002 - assembly language fundamentals/

003.01 - hll mapping/

003.02 - hll mapping/

004 - manual decompilation/

005 - algorithm analysis/

006 - crash analysis/

007 - file understanding/

008 - copy protection analysis/

009 - unpacking/

010 - vulnerability analysis/

011 - malware analysis/

Felicitarile mele pentru link