Computer Crime Investigation Department of China Criminal Police University, Shenyang, China

---

Abstract—Malware analysis is becoming an important specialization in the field of digital investigation. Reverse analysis is the most common method in analyzing malware. The reverse analysis process is an advanced and efficient method that exposes the intention and processes of malware. This paper introduces the basic concepts, methods, and tools of the reverse analysis process. A true case study of malware in China, used to obtain QQ account information and passwords, is presented to illustrate the whole process of the reverse analysis process of malware from the aspects of checking pack, unpacking, breakpoint setting, program tracing, anti-kill technique and key information acquiring.

Index Terms—Malware; Digital Investigation; Reversing; QQ Passwords Collecting; Start Function; Shell; Windows API

[PDF]

Cite: Luo Wenhua, Li Na, and Tang Yanjun, "Reverse Analysis of Malwares: A Case Study on QQ Passwords Collection," Journal of Software vol. 7, no. 8, pp. 1706-1712, 2012.