# Common Malware Indicators Reference

## Suspicious Import Functions

### Process Injection/Manipulation
- `CreateRemoteThread` - Inject code into another process
- `WriteProcessMemory` - Write to another process's memory
- `VirtualAllocEx` - Allocate memory in another process
- `OpenProcess` - Access another process
- `NtUnmapViewOfSection` - Process hollowing technique
- `SetThreadContext` - Modify thread execution
- `ResumeThread` - Resume suspended thread (often after injection)
- `QueueUserAPC` - APC injection technique

### Keylogging
- `SetWindowsHookEx` - Install keyboard hooks
- `GetAsyncKeyState` - Poll keyboard state
- `GetForegroundWindow` - Get active window title
- `GetKeyState` - Check key status

### Network Activity
- `InternetOpen` / `InternetOpenUrl` - WinINet HTTP requests
- `HttpSendRequest` - Send HTTP request
- `send` / `recv` - Raw socket communication
- `WSAStartup` - Initialize Winsock
- `connect` / `socket` - Network connections
- `URLDownloadToFile` - Download files from URLs

### Persistence Mechanisms
- `RegSetValueEx` / `RegCreateKeyEx` - Registry manipulation
- `CreateService` - Install Windows service
- `StartService` - Start service
- `ITaskService` / `ITaskFolder::RegisterTaskDefinition` - COM interfaces for scheduled task creation; `schtasks.exe /create` is the command-line equivalent

### Stealth/Anti-Analysis
- `IsDebuggerPresent` - Debugger detection
- `CheckRemoteDebuggerPresent` - Remote debugger check
- `NtQueryInformationProcess` - Process information (anti-debug)
- `GetTickCount` - Timing checks (anti-sandbox)
- `Sleep` - Delay execution (sandbox evasion)
- `FindWindow` - Look for analysis tools

### EDR/Telemetry Evasion
- `EtwEventWrite` / `NtTraceEvent` - ETW patching target; writing 0xC3 (ret) to prologue blinds EDR telemetry
- `AmsiScanBuffer` / `AmsiScanString` / `AmsiInitialize` - AMSI bypass targets; patched to return S_OK (0) with AMSI_RESULT_CLEAN (0), or to return E_INVALIDARG so the caller treats the result as no threat
- `UpdateProcThreadAttribute` - PPID spoofing when called with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute
- `VirtualProtect` - Required before patching; look for calls targeting ntdll.dll or amsi.dll memory ranges
- `GetProcAddress` + `LoadLibrary` - Runtime API resolution to avoid static import evidence (common in syscall stubs)

### Callback-based Shellcode Execution
- `EnumChildWindows` / `EnumDesktopWindows` - Callback used as execution primitive instead of CreateThread
- `CreateTimerQueueTimer` - Timer callback used to invoke shellcode
- `TpAllocWork` / `TpPostWork` / `TpReleaseWork` - Threadpool callbacks for shellcode dispatch
- `SetTimer` / `EnumSystemLocales` / `EnumTimeFormatsEx` - Less common callback execution primitives

### File Manipulation
- `CreateFile` / `WriteFile` / `ReadFile` - File I/O
- `DeleteFile` - Delete files
- `MoveFile` / `CopyFile` - File operations
- `FindFirstFile` / `FindNextFile` - Directory enumeration

### Encryption/Encoding
- `CryptEncrypt` / `CryptDecrypt` - Data encryption
- `CryptAcquireContext` - Crypto provider setup
- `CryptGenKey` - Generate encryption keys

## Suspicious String Patterns

### Network Indicators
- Hardcoded IP addresses (especially RFC1918 or suspicious IPs)
- Domain names (especially newly registered or suspicious TLDs)
- URL patterns: `http://`, `https://`, `ftp://`
- Port numbers in strings (especially non-standard ports)
- User-Agent strings (especially custom/unusual ones)
- Email addresses (especially for data exfiltration)

### File Paths
- `%APPDATA%`, `%TEMP%`, `%LOCALAPPDATA%` - Common malware locations
- `\Microsoft\Windows\Start Menu\Programs\Startup\` - Persistence
- `C:\ProgramData\` - Hidden location
- Hidden folders: `$Recycle.Bin`, `System Volume Information`

### Registry Keys
**Persistence (Run Keys):**
- `Software\Microsoft\Windows\CurrentVersion\Run`
- `Software\Microsoft\Windows\CurrentVersion\RunOnce`
- `SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices`

**System Modification:**
- `SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon` (especially Userinit, Shell)
- `SYSTEM\CurrentControlSet\Services` - Service installation
- `SOFTWARE\Microsoft\Windows\CurrentVersion\policies` - Policy changes

### Commands and Scripts
- PowerShell indicators:
  - `-EncodedCommand` - Base64 encoded commands
  - `-ExecutionPolicy Bypass` - Bypass script restrictions
  - `-WindowStyle Hidden` - Hide execution
  - `DownloadString`, `DownloadFile` - Download payloads
  - `IEX` (Invoke-Expression) - Execute code

- CMD indicators:
  - `cmd.exe /c` - Execute command
  - `schtasks` - Task scheduling
  - `reg add` - Registry manipulation
  - `netsh` - Network/firewall changes
  - `wmic` - WMI commands
  - `rundll32` - Execute DLL functions

### Encoding/Obfuscation
- Base64 encoded strings (check for padding: `==`)
- Hex encoded data
- XOR key patterns
- Reversed strings
- Unicode/wide character strings

### Cryptocurrency
- Bitcoin addresses (start with 1, 3, or bc1)
- Ethereum addresses (0x followed by 40 hex chars)
- Monero addresses
- Wallet-related terms: "wallet.dat", "cryptocurrency"

### Ransomware Indicators
- File extension strings: `.encrypted`, `.locked`, `.crypto`, etc.
- Ransom note filenames: `README.txt`, `HOW_TO_DECRYPT.txt`
- Payment terms: "bitcoin", "decrypt", "ransom", "payment"
- Encryption terms: "AES", "RSA", "encrypted"

## Suspicious File Characteristics

### PE Header Anomalies
- Compilation timestamp in the future
- Compilation timestamp too old for file features
- Mismatched architecture in headers
- Unusual section names (normal: `.text`, `.data`, `.rdata`, `.rsrc`)
- High entropy sections (>7.0 suggests encryption/packing)
- Overlapping sections
- Large overlay data
- Missing or invalid digital signatures

### Entropy Analysis
- **Low entropy (0-3):** Likely unencrypted, readable data
- **Medium entropy (3-5):** Typical compiled code
- **High entropy (7-8):** Packed, encrypted, or compressed
- Check individual PE sections for high entropy

### Packer Signatures
**Common packers:**
- UPX (common, legitimate and malicious)
- ASPack
- PECompact
- Themida/WinLicense (strong protection)
- Armadillo
- VMProtect
- Enigma Protector
- Custom/unknown packers (more suspicious)

### File Size Oddities
- Very small for claimed functionality (<10KB for complex malware)
- Unusually large resources section
- Significant overlay data
- File size doesn't match claimed type

## Behavioral Indicators

### Anti-Analysis Behaviors
- Checks for VM artifacts (VMware, VirtualBox, QEMU)
- Looks for debugger presence
- Timing checks (execution delays)
- Checks for analysis tools (Process Monitor, Wireshark, IDA)
- Sandbox detection (limited resources, username checks)
- Parent process verification
- Mouse movement monitoring
- Checks for user interaction

### Modern EDR/AV Evasion Techniques

**ETW Patching:**
- Overwrites the prologue of `EtwEventWrite` or `NtTraceEvent` with a `ret` instruction (0xC3) to suppress Event Tracing for Windows telemetry
- Look for: `VirtualProtect` → `WriteProcessMemory`/`memcpy` targeting ntdll address space, followed by restoration of original page protections
- Effect: EDR and ETW-based logging goes blind for the process lifetime

**AMSI Bypass:**
- Patches `AmsiScanBuffer` or `AmsiScanString` in amsi.dll to return S_OK (0) with `AMSI_RESULT_CLEAN` (0), or to return E_INVALIDARG so the caller treats the result as no threat; disables script content scanning
- Look for: `LoadLibrary("amsi.dll")` + `GetProcAddress` + `VirtualProtect` + small write (1-8 bytes); or `AmsiInitialize` never called while PowerShell/script engine is used
- Effect: Malicious PowerShell, VBScript, or JScript passes AMSI unchecked

**Direct Syscalls / SysWhispers:**
- Bypasses EDR hooks placed on ntdll.dll exports by issuing raw syscall/sysenter instructions with the correct System Service Number (SSN)
- Look for: `syscall` or `sysenter` instructions in non-system modules (use `objdump`/`dumpbin`); runtime SSN resolution via ntdll stub scanning (Hell's Gate, Halo's Gate, Tartarus Gate patterns); absence of ntdll imports for expected operations (no `NtAllocateVirtualMemory` import but memory is allocated)
- Common SSNs targeted: NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx, NtProtectVirtualMemory

**PPID Spoofing:**
- Creates a child process with a forged parent PID by passing a handle to the target parent via `UpdateProcThreadAttribute(PROC_THREAD_ATTRIBUTE_PARENT_PROCESS)` before calling `CreateProcess`
- Look for: `OpenProcess` on an unrelated high-privilege process (e.g., explorer.exe, svchost.exe) immediately before `CreateProcess`; process tree in logs showing implausible parent-child relationships
- Effect: Evades detections that trigger on suspicious parent-child pairs (e.g., Word spawning cmd.exe)

**Module Stomping / DLL Hollowing:**
- Loads a legitimate, signed DLL into memory then overwrites its `.text` section with malicious shellcode, so execution appears to originate from a trusted module
- Look for: `LoadLibrary` on an unexpected DLL followed by `VirtualProtect(PAGE_EXECUTE_READWRITE)` and `WriteProcessMemory`/`memcpy` into that DLL's base address; signed DLL mapped but exports resolve to unexpected code
- Distinguish from process hollowing: the host process is not suspended — the stomped DLL simply runs attacker code under a legitimate module name

### Persistence Techniques
- Registry Run key modification
- Scheduled task creation
- Service installation
- WMI event subscriptions
- DLL hijacking/search order hijacking
- AppInit_DLLs registry key
- Startup folder files
- Browser extension installation

### Network Patterns
- Beaconing (regular C2 communication)
- HTTP with suspicious User-Agents
- Raw socket connections
- IRC protocols
- DNS tunneling (unusual DNS queries)
- TOR usage
- Fast flux domains

### Data Exfiltration
- Unusual outbound data volumes
- Screenshots being taken
- Credential harvesting
- Browser data collection
- Keylogger output transmission
- File upload to external servers

## Red Flags by File Type

### Executable Files (.exe, .dll, .scr)
- No digital signature or invalid signature
- Packed/protected
- Very few imports (possibly resolved at runtime)
- Unusual compilation timestamp
- Suspicious filename mimicking system files

### Script Files (.ps1, .vbs, .js, .bat)
- Heavy obfuscation
- Base64 encoded sections
- Download and execute patterns
- WMI usage for execution
- Registry manipulation

### Office Documents (.doc, .xls, .docx, .xlsx)
- Macros enabled
- Auto-execute macro names (AutoOpen, Auto_Open, Workbook_Open)
- External template references
- Embedded objects
- Suspicious OLE streams

### Archive Files (.zip, .rar, .7z)
- Executable files with misleading extensions
- Multi-layer nested archives
- Password-protected archives (especially with generic passwords)
- Suspicious filenames inside

## Quick Classification Patterns

### Ransomware
- File encryption APIs
- Many file I/O operations
- File extension changes
- Ransom note creation
- Cryptocurrency addresses
- File deletion after encryption

### Trojan/RAT
- Network communication APIs
- Remote control capabilities
- Screen capture
- File transfer
- Command execution
- Persistence mechanisms

### Infostealer
- Browser data access
- Credential harvesting
- Clipboard monitoring
- Form grabbing
- Cookie stealing
- Cryptocurrency wallet targeting

### Dropper/Loader
- Embedded resources
- Creates and executes files
- Downloads additional payloads
- Process injection
- Minimal visible functionality

### Cryptominer
- High CPU usage
- Mining pool connections
- Cryptocurrency-related strings
- GPU access APIs
- Persistence with hidden processes

## Tool Detection Strings

Malware often checks for these analysis tools:

**Debuggers:**
- OllyDbg, x64dbg, IDA Pro, WinDbg
- Immunity Debugger

**Monitors:**
- Process Monitor (procmon), Process Explorer
- Wireshark, Fiddler
- TCPView, RegShot

**Sandboxes:**
- Cuckoo, Joe Sandbox
- Any.Run, Hybrid Analysis
- VMRay, FireEye

**VM Artifacts:**
- "VMware", "VirtualBox", "QEMU", "Hyper-V"
- "vmmouse", "vmhgfs", "vboxguest"
- Registry keys related to VMs

**Analysis Artifacts:**
- Username: "sandbox", "malware", "virus", "sample"
- Hostname: "VIRUS-PC", "MALWARE-ANALYSIS"
- Limited resources (low RAM, CPU count)