Malware Analysis: Runtime Linking in a Sample with No Imports

Summary

The video introduces runtime linking through analysis of a malware sample with no static imports or useful strings, showing how analysis tools help identify runtime-resolved function pointers and related behavior.

Key points

• Runtime linking lets malware resolve operating-system functionality at runtime rather than relying on a conventional import directory.
• The sample is described by the presenter as actual malware; its hash is shown, but no hash value is present in the supplied transcript.
• Initial triage finds a valid PE file with no imports and few useful strings.
• FLOSS identifies stack strings, while Kappa reports behaviors including loader-data access, resolving functions through PE exports, and XOR-encoding data.
• IDA analysis shows global variables initialized to zero that appear to be populated at runtime and used as function pointers.

People

Tools

Related Articles

• Signed Fake PeaZip MSI Installs a DLL-Sideloading, Self-Updating Loaderrogueauthority.orgFLOSS
• Signed PuTTY Installer Hides a Node.js Malware Loaderrogueauthority.orgFLOSS
• New Spyder Downloader Uses Sandbox Evasion and Targets South Asian Policerogueauthority.orgFLOSS
• Midnight Mimosa Malware Preinstalled on Android Phones Enables Ad Fraud and Proxy Botnetsbitdefender.comIDA
• Yarden Shafir Discusses Windows AI Agent Isolation and Security ResearchJohn HammondIDA