reverse-skills-max/vendor-new/malware-analysis-claude-skills/malware-triage/references/indicators.md

Common Malware Indicators Reference

Suspicious Import Functions

Process Injection/Manipulation

• CreateRemoteThread - Inject code into another process
• WriteProcessMemory - Write to another process's memory
• VirtualAllocEx - Allocate memory in another process
• OpenProcess - Access another process
• NtUnmapViewOfSection - Process hollowing technique
• SetThreadContext - Modify thread execution
• ResumeThread - Resume suspended thread (often after injection)
• QueueUserAPC - APC injection technique

Keylogging

• SetWindowsHookEx - Install keyboard hooks
• GetAsyncKeyState - Poll keyboard state
• GetForegroundWindow - Get active window title
• GetKeyState - Check key status

Network Activity

• InternetOpen / InternetOpenUrl - WinINet HTTP requests
• HttpSendRequest - Send HTTP request
• send / recv - Raw socket communication
• WSAStartup - Initialize Winsock
• connect / socket - Network connections
• URLDownloadToFile - Download files from URLs

Persistence Mechanisms

• RegSetValueEx / RegCreateKeyEx - Registry manipulation
• CreateService - Install Windows service
• StartService - Start service
• ITaskService / ITaskFolder::RegisterTaskDefinition - COM interfaces for scheduled task creation; schtasks.exe /create is the command-line equivalent

Stealth/Anti-Analysis

• IsDebuggerPresent - Debugger detection
• CheckRemoteDebuggerPresent - Remote debugger check
• NtQueryInformationProcess - Process information (anti-debug)
• GetTickCount - Timing checks (anti-sandbox)
• Sleep - Delay execution (sandbox evasion)
• FindWindow - Look for analysis tools

EDR/Telemetry Evasion

• EtwEventWrite / NtTraceEvent - ETW patching target; writing 0xC3 (ret) to prologue blinds EDR telemetry
• AmsiScanBuffer / AmsiScanString / AmsiInitialize - AMSI bypass targets; patched to return S_OK (0) with AMSI_RESULT_CLEAN (0), or to return E_INVALIDARG so the caller treats the result as no threat
• UpdateProcThreadAttribute - PPID spoofing when called with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute
• VirtualProtect - Required before patching; look for calls targeting ntdll.dll or amsi.dll memory ranges
• GetProcAddress + LoadLibrary - Runtime API resolution to avoid static import evidence (common in syscall stubs)

Callback-based Shellcode Execution

• EnumChildWindows / EnumDesktopWindows - Callback used as execution primitive instead of CreateThread
• CreateTimerQueueTimer - Timer callback used to invoke shellcode
• TpAllocWork / TpPostWork / TpReleaseWork - Threadpool callbacks for shellcode dispatch
• SetTimer / EnumSystemLocales / EnumTimeFormatsEx - Less common callback execution primitives

File Manipulation

• CreateFile / WriteFile / ReadFile - File I/O
• DeleteFile - Delete files
• MoveFile / CopyFile - File operations
• FindFirstFile / FindNextFile - Directory enumeration

Encryption/Encoding

• CryptEncrypt / CryptDecrypt - Data encryption
• CryptAcquireContext - Crypto provider setup
• CryptGenKey - Generate encryption keys

Suspicious String Patterns

Network Indicators

• Hardcoded IP addresses (especially RFC1918 or suspicious IPs)
• Domain names (especially newly registered or suspicious TLDs)
• URL patterns: http://, https://, ftp://
• Port numbers in strings (especially non-standard ports)
• User-Agent strings (especially custom/unusual ones)
• Email addresses (especially for data exfiltration)

File Paths

• %APPDATA%, %TEMP%, %LOCALAPPDATA% - Common malware locations
• \Microsoft\Windows\Start Menu\Programs\Startup\ - Persistence
• C:\ProgramData\ - Hidden location
• Hidden folders: $Recycle.Bin, System Volume Information

Registry Keys

Persistence (Run Keys):

• Software\Microsoft\Windows\CurrentVersion\Run
• Software\Microsoft\Windows\CurrentVersion\RunOnce
• SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

System Modification:

• SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon (especially Userinit, Shell)
• SYSTEM\CurrentControlSet\Services - Service installation
• SOFTWARE\Microsoft\Windows\CurrentVersion\policies - Policy changes

Commands and Scripts

• PowerShell indicators:

  • -EncodedCommand - Base64 encoded commands
  • -ExecutionPolicy Bypass - Bypass script restrictions
  • -WindowStyle Hidden - Hide execution
  • DownloadString, DownloadFile - Download payloads
  • IEX (Invoke-Expression) - Execute code

• CMD indicators:

  • cmd.exe /c - Execute command
  • schtasks - Task scheduling
  • reg add - Registry manipulation
  • netsh - Network/firewall changes
  • wmic - WMI commands
  • rundll32 - Execute DLL functions

Encoding/Obfuscation

• Base64 encoded strings (check for padding: ==)
• Hex encoded data
• XOR key patterns
• Reversed strings
• Unicode/wide character strings

Cryptocurrency

• Bitcoin addresses (start with 1, 3, or bc1)
• Ethereum addresses (0x followed by 40 hex chars)
• Monero addresses
• Wallet-related terms: "wallet.dat", "cryptocurrency"

Ransomware Indicators

• File extension strings: .encrypted, .locked, .crypto, etc.
• Ransom note filenames: README.txt, HOW_TO_DECRYPT.txt
• Payment terms: "bitcoin", "decrypt", "ransom", "payment"
• Encryption terms: "AES", "RSA", "encrypted"

Suspicious File Characteristics

PE Header Anomalies

• Compilation timestamp in the future
• Compilation timestamp too old for file features
• Mismatched architecture in headers
• Unusual section names (normal: .text, .data, .rdata, .rsrc)
• High entropy sections (>7.0 suggests encryption/packing)
• Overlapping sections
• Large overlay data
• Missing or invalid digital signatures

Entropy Analysis

• Low entropy (0-3): Likely unencrypted, readable data
• Medium entropy (3-5): Typical compiled code
• High entropy (7-8): Packed, encrypted, or compressed
• Check individual PE sections for high entropy

Packer Signatures

Common packers:

• UPX (common, legitimate and malicious)
• ASPack
• PECompact
• Themida/WinLicense (strong protection)
• Armadillo
• VMProtect
• Enigma Protector
• Custom/unknown packers (more suspicious)

File Size Oddities

• Very small for claimed functionality (<10KB for complex malware)
• Unusually large resources section
• Significant overlay data
• File size doesn't match claimed type

Behavioral Indicators

Anti-Analysis Behaviors

• Checks for VM artifacts (VMware, VirtualBox, QEMU)
• Looks for debugger presence
• Timing checks (execution delays)
• Checks for analysis tools (Process Monitor, Wireshark, IDA)
• Sandbox detection (limited resources, username checks)
• Parent process verification
• Mouse movement monitoring
• Checks for user interaction

Modern EDR/AV Evasion Techniques

ETW Patching:

• Overwrites the prologue of EtwEventWrite or NtTraceEvent with a ret instruction (0xC3) to suppress Event Tracing for Windows telemetry
• Look for: VirtualProtect → WriteProcessMemory/memcpy targeting ntdll address space, followed by restoration of original page protections
• Effect: EDR and ETW-based logging goes blind for the process lifetime

AMSI Bypass:

• Patches AmsiScanBuffer or AmsiScanString in amsi.dll to return S_OK (0) with AMSI_RESULT_CLEAN (0), or to return E_INVALIDARG so the caller treats the result as no threat; disables script content scanning
• Look for: LoadLibrary("amsi.dll") + GetProcAddress + VirtualProtect + small write (1-8 bytes); or AmsiInitialize never called while PowerShell/script engine is used
• Effect: Malicious PowerShell, VBScript, or JScript passes AMSI unchecked

Direct Syscalls / SysWhispers:

• Bypasses EDR hooks placed on ntdll.dll exports by issuing raw syscall/sysenter instructions with the correct System Service Number (SSN)
• Look for: syscall or sysenter instructions in non-system modules (use objdump/dumpbin); runtime SSN resolution via ntdll stub scanning (Hell's Gate, Halo's Gate, Tartarus Gate patterns); absence of ntdll imports for expected operations (no NtAllocateVirtualMemory import but memory is allocated)
• Common SSNs targeted: NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx, NtProtectVirtualMemory

PPID Spoofing:

• Creates a child process with a forged parent PID by passing a handle to the target parent via UpdateProcThreadAttribute(PROC_THREAD_ATTRIBUTE_PARENT_PROCESS) before calling CreateProcess
• Look for: OpenProcess on an unrelated high-privilege process (e.g., explorer.exe, svchost.exe) immediately before CreateProcess; process tree in logs showing implausible parent-child relationships
• Effect: Evades detections that trigger on suspicious parent-child pairs (e.g., Word spawning cmd.exe)

Module Stomping / DLL Hollowing:

• Loads a legitimate, signed DLL into memory then overwrites its .text section with malicious shellcode, so execution appears to originate from a trusted module
• Look for: LoadLibrary on an unexpected DLL followed by VirtualProtect(PAGE_EXECUTE_READWRITE) and WriteProcessMemory/memcpy into that DLL's base address; signed DLL mapped but exports resolve to unexpected code
• Distinguish from process hollowing: the host process is not suspended — the stomped DLL simply runs attacker code under a legitimate module name

Persistence Techniques

• Registry Run key modification
• Scheduled task creation
• Service installation
• WMI event subscriptions
• DLL hijacking/search order hijacking
• AppInit_DLLs registry key
• Startup folder files
• Browser extension installation

Network Patterns

• Beaconing (regular C2 communication)
• HTTP with suspicious User-Agents
• Raw socket connections
• IRC protocols
• DNS tunneling (unusual DNS queries)
• TOR usage
• Fast flux domains

Data Exfiltration

• Unusual outbound data volumes
• Screenshots being taken
• Credential harvesting
• Browser data collection
• Keylogger output transmission
• File upload to external servers

Red Flags by File Type

Executable Files (.exe, .dll, .scr)

• No digital signature or invalid signature
• Packed/protected
• Very few imports (possibly resolved at runtime)
• Unusual compilation timestamp
• Suspicious filename mimicking system files

Script Files (.ps1, .vbs, .js, .bat)

• Heavy obfuscation
• Base64 encoded sections
• Download and execute patterns
• WMI usage for execution
• Registry manipulation

Office Documents (.doc, .xls, .docx, .xlsx)

• Macros enabled
• Auto-execute macro names (AutoOpen, Auto_Open, Workbook_Open)
• External template references
• Embedded objects
• Suspicious OLE streams

Archive Files (.zip, .rar, .7z)

• Executable files with misleading extensions
• Multi-layer nested archives
• Password-protected archives (especially with generic passwords)
• Suspicious filenames inside

Quick Classification Patterns

Ransomware

• File encryption APIs
• Many file I/O operations
• File extension changes
• Ransom note creation
• Cryptocurrency addresses
• File deletion after encryption

Trojan/RAT

• Network communication APIs
• Remote control capabilities
• Screen capture
• File transfer
• Command execution
• Persistence mechanisms

Infostealer

• Browser data access
• Credential harvesting
• Clipboard monitoring
• Form grabbing
• Cookie stealing
• Cryptocurrency wallet targeting

Dropper/Loader

• Embedded resources
• Creates and executes files
• Downloads additional payloads
• Process injection
• Minimal visible functionality

Cryptominer

• High CPU usage
• Mining pool connections
• Cryptocurrency-related strings
• GPU access APIs
• Persistence with hidden processes

Tool Detection Strings

Malware often checks for these analysis tools:

Debuggers:

• OllyDbg, x64dbg, IDA Pro, WinDbg
• Immunity Debugger

Monitors:

• Process Monitor (procmon), Process Explorer
• Wireshark, Fiddler
• TCPView, RegShot

Sandboxes:

• Cuckoo, Joe Sandbox
• Any.Run, Hybrid Analysis
• VMRay, FireEye

VM Artifacts:

• "VMware", "VirtualBox", "QEMU", "Hyper-V"
• "vmmouse", "vmhgfs", "vboxguest"
• Registry keys related to VMs

Analysis Artifacts:

• Username: "sandbox", "malware", "virus", "sample"
• Hostname: "VIRUS-PC", "MALWARE-ANALYSIS"
• Limited resources (low RAM, CPU count)