From the course: Ethical Hacking: The Complete Malware Analysis Process

Unlock this course with a free trial

Join today to access over 25,300 courses taught by industry experts.

Polymorphic malware

Polymorphic malware

From the course: Ethical Hacking: The Complete Malware Analysis Process

Start my 1-month free trial Buy for my team

Polymorphic malware

“

- [Man] Let's take a look at some polymorphic code. This is a small program called "Target," written in Matter Assembler, which demonstrates how morphing works. Let's have a quick look at it, and then run it in the debugger to see how it works. The first section of the code injects a malware into this program. It reads a binary file; we'll call it "malware," and writes it into its own code space. This mimics what we'd see with a buffer overflow. We then display a "hello world" message, followed by some code, which finally ends with an exit process. I've loaded the target program into a debugger to show exactly what happens inside the computer when this code runs. I'm using x32dbg. And I've loaded target.exe and positioned to the start of user code. Note that if you want to try this yourself, you'll need to modify the MASM32 assembly and linking file to enable .txt segments to be writeable. We can see the initial inject code here. Let's step through it. The first thing we do, is to…

Contents