Visualizing compiled executables for malware analysis

6th International Workshop on Visualization for Cyber Security 2009, VizSec 2009 - Proceedings

Volumn , Issue , 2009, Pages 27-32

  Quist, Daniel A ^a   Liebrock, Lorie M ^b  

^a LOS ALAMOS NATIONAL LABORATORY   (United States)

^b NEW MEXICO INSTITUTE OF MINING AND TECHNOLOGY   (United States)

Author keywords

Dynamic analysis; Reverse engineering; Visualization

Indexed keywords

EXECUTABLES; HYPERVISOR; KEY FEATURE; MALWARES; PROGRAM EXECUTION; REVERSE ENGINEERS; STEEP LEARNING CURVE; USER STUDY;

COMPUTER CRIME; ETHERS; FEATURE EXTRACTION; PROGRAM TRANSLATORS; REENGINEERING; REVERSE ENGINEERING; VISUALIZATION;

DYNAMIC ANALYSIS;

EID: 77949357077     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/VIZSEC.2009.5375539     Document Type: Conference Paper

References (23)

1. K. Alkio. Mbr rootkit, a new breed of malware. F-Secure Blog. http://www.f-secure.com/weblog/archives/ 00001393.html.
2. U. Bayer. Ttanalyze: A tool for analyzing malware. Masters thesis, Technical University of Vienna, 2005.
3. J. Bohnet and J. Döllner. Visual exploration of function call graphs for feature location in complex software systems. In SoftVis '06: Proceedings of the 2006 ACM symposium on Software visualization, pages 95-104, New York, NY, USA, 2006. ACM.
4. C. Cifuentes, T. Waddington, and M. V. Emmerik. Computer security analysis through decompilation and high-level debugging. In Eighth Working Conference on Reverse Engineering. IEEE Computer Society Washington, DC, USA, 2001.
5. A. Dinaburg, P. Royal, M. Sharif, and W. Lee. Ether: Malware analysis via hardware virtualization extensions. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), Nov. 2008.
6. P. Ferrie. Attacks on virtual machine emulators. Symantec Advanced Threat Research, 2006.
7. P. Ferrie. Anti-unpacker tricks - part one. Virus Bulletin, 2008.
8. F. Guo, P. Ferrie, and T.-c. Chiueh. A study of the packer and its solutions. In RAID, Cambridge, Massachusettes.
9. N. Harbour. Advanced software armoring and polymorphic kung-fu. In Defcon 16, Aug. 2008.
10. HBGary. Responder professional. Product Description Page. https://www.hbgary.com/products-services/ responder-professional/.
11. Hexrays. Ida pro disassembler and debugger. Product Description Page. http://www.hex-rays.com/idapro/.
12. M. G. Kang, P. Poosankam, and H. Yin. Renovo: A hidden code extractor for packed executables. In Proceedings of the 5th ACM Workshop on Recurring Malcode (WORM), Oct. 2007.
13. J. Ma, J. Dunagan, H. J.Wang, S. Savage, and G. M. Voelker. Finding diversity in remote code injection exploits. In Internet Measurement Conference, Rio de Janeiro, Brazil, 2006. ACM.
14. N. Nethercote and J. Seward. Valgrind: A framework for heavyweight dynamic binary instrumentation. In ACM SIGPLAN 2007 Conference on Programming Language Design and Implementation (PLDI 2007), San Diego, CA, 2007. ACM.
15. D. Quist and V. Smith. Covert debugging: Circumventing software armoring. In Blackhat USA, Aug. 2007.
16. P. Royal. Alternative medicine: The malware analyst's blue pill. In Blackhat USA, Aug. 2008.
17. P. Royal, M. Halpin, D. Dagon, R. Edmonds, andW. Lee. Polyunpack: Automating the hidden-code extraction of unpack-executing malware, 2006.
18. J. Stewart. Ollybone: Semi-automatic unpacking on ia-32. In Defcon 14, Las Vegas, NV, 2006.
19. A. Telea and L. Voinea. An interactive reverse engineering environment for large-scale c++ code. In SoftVis '08: Proceedings of the 4th ACM symposium on Software visualization, pages 67-76, New York, NY, USA, 2008. ACM.
20. A. Vasudevan and R. Yerraballi. Spike: Engineering malware analysis tools using unobtrusive binary-instrumentation. volume 48, Hobart, Tasmania, Australia, January 2006. Australian Computer Society, Inc.
21. Y. Xia, K. Fairbanks, and H. Owen. Visual analysis of program flow data with data propagation. In VizSec '08: Proceedings of the 5th international workshop on Visualization for Computer Security, pages 26-35, Berlin, Heidelberg, 2008. Springer-Verlag.
22. O. Yuschuk. Ollydbg debugger and disassembler. Product Description Page. http://www.ollydbg.de/.
23. Zynamics. Binnavi. Company Product Description Page. http: //www.zynamics.com/binnavi.html.