Tips for Reverse-Engineering Malicious Code

Reversing malicious Windows executables involves examining static properties, identifying suspicious strings and API calls, performing behavior analysis, and using disassemblers and debuggers. You'll also find registers, common assembly instructions, and risky API calls for code injection, process hollowing, and anti-analysis.

This cheat sheet outlines tips for reversing malicious Windows executables via static and dynamic code analysis with the help of a debugger and a disassembler. To print it, use the one-page PDF version. You can also edit the Word version to customize it for your own needs.

Overview of the Code Analysis Process

1. Examine static properties of the Windows executable for initial assessment and triage.
2. Identify strings and API calls that highlight the program’s suspicious or malicious capabilities.
3. Perform automated and manual behavior analysis to gather additional details.
4. Emulate code execution with tools such as Speakeasy to find areas for further analysis.
5. Use a disassembler and decompiler to statically examine code related to risky strings and APIs.
6. Use a debugger for dynamic analysis to examine how risky strings and API calls are used.
7. If appropriate, unpack the code and its artifacts.
8. As your understanding of the code increases, add comments, labels; rename functions, variables.
9. Progress to examine the code that references or depends upon the code you’ve already analyzed.
10. Repeat steps 5-9 above as necessary (the order may vary) until your analysis objectives are met.

Common 32-Bit Registers and Uses

Common x86 Assembly Instructions

Understanding 64-Bit Registers

• EAX→RAX, ECX→RCX, EBX→RBX, ESP→RSP, EIP→RIP
• Additional 64-bit registers are R8-R15.
• In 64-bit processes, GS:[0x60] points to the PEB.
• Stack data is often accessed via RSP, not RBP.

|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| R8 (64 bits)
________________________________|||||||||||||||||||||||||||||||| R8D (32 bits)
________________________________________________|||||||||||||||| R8W (16 bits)
________________________________________________________|||||||| R8B (8 bits)

Decoding Conditional Jumps

Passing Parameters to Functions on Windows

Some Risky Windows API Calls

• Code injection: VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, QueueUserAPC
• Process hollowing: CreateProcess, NtUnmapViewOfSection, SetThreadContext
• Dynamic API resolution: LoadLibrary, GetProcAddress
• Data theft: CryptUnprotectData, GetClipboardData, GetAsyncKeyState, SetWindowsHookEx
• Anti-analysis: IsDebuggerPresent, CheckRemoteDebuggerPresent, GetTickCount, GlobalMemoryStatusEx
• Embedded resources: FindResource, LockResource
• Unpacking/self-injection: VirtualAlloc, VirtualProtect
• Query artifacts: CreateMutex, RegOpenKeyEx
• Execute a program: CreateProcess, ShellExecute
• Web interactions: InternetOpen, HttpSendRequest, InternetReadFile, WinHttpOpenRequest

Additional Code Analysis Tips

• Look at jumps and calls to assess how the sample flows from one “interesting” code block to another.
• TRACE each artifact: Target it, pull References, Analyze the caller, Contextualize, Explain.
• Ask an AI agent to explain a function or check your theory, then confirm the answer in the code.
• If code analysis takes too long, consider whether behavior or memory analysis will meet your goals.
• When looking for API calls, know the official API names and the associated native APIs (Nt, Zw, Rtl).
• For .NET samples, decompile with ILSpy or dnSpyEx, and try de4dot to deobfuscate.

Thanks to Anuj Soni for feedback and to Ryan Chapman for the idea behind the TRACE acronym. This cheat sheet is distributed under the Creative Commons Attribution 4.0 International License.