Windows Malware Analysis Essentials

Debriefing – seeing the forest for the trees

The malware sample of choice is called Dark Seoul. You can get the sample from http://contagiodump.blogspot.in/2013/03/darkseoul-jokra-mbr-wiper-samples.html.

This malware is chosen for this chapter as it is relevant enough to be featured in a number of news reports and advisories—http://blog.xecure-lab.com/2013/03/lets-gossip-what-happens-in-south-korea.html and http://www.secureworks.com/cyber-threat-intelligence/threats/wiper-malware-analysis-attacking-korean-financial-sector/. It is also widely available and the features are quite interesting without being overly complex for the purpose of learning malware analysis. Since most books focus on concepts and techniques in isolation, getting an idea of ...