Glossary

Short definitions of the words that come up in the articles. They are written for people who are new to the field, not for a glossary exam.

Anti-debug

Checks that a program runs to find out if an analyst is stepping through it in a debugger. Common tricks include reading the BeingDebugged flag (a one-byte field that Windows sets to 1 when a debugger is attached) in the PEB (Process Environment Block, an internal Windows structure inside each process), timing how long an instruction block takes or calling Windows API (API, Application Programming Interface) functions that report attached debuggers.See also: Debugger, PEB, WinAPI, API.

Anti-VM / sandbox evasion

Tricks malware uses to notice it is running inside a virtual machine (VM, a software-simulated computer), a sandbox or a debugger by checking for virtual machine drivers, odd hardware values or analysis tools in the process list, so it can quit or play innocent instead of showing its real behaviour.See also: Sandbox, Debugger.

API

Application Programming Interface: a documented set of functions that an operating system or library exposes so programs can request services such as opening files, allocating memory or using the network.

Base64

A 64-character base encoding scheme that turns raw bytes into printable ASCII (American Standard Code for Information Interchange, basic English letters, digits and symbols) text. Malware uses it to carry binary blobs or configuration strings inside text protocols and scripts without corrupting them.

Botnet

A group of infected machines (bots) controlled by the same operator. The bots usually report to a C2 (command and control, the server that gives the malware orders) server and can be told to run a miner, steal data, send spam or take part in a DDoS (distributed denial of service, flooding a target with traffic) attack.See also: C2 / C&C, Cryptominer, DDoS.

Breakpoint

A marker set inside a debugger that pauses a program when execution reaches a chosen instruction or memory address. Stopping the program at the right spot lets an analyst inspect registers, stack values and decrypted data in memory.See also: Debugger, Register.

C2 / C&C

Command and control (abbreviated C2 or C&C): the server, or the communication channel, that a compromised machine uses to receive orders and send results. "C2 traffic" is the network communication between the malware and that server.

Checksum

A small number calculated from a block of data or a string name. Malware frequently replaces human-readable Windows API (API, Application Programming Interface) names with numeric checksums such as CRC32 (a 32-bit cyclic redundancy check) so an analyst cannot see which functions the binary imports just by reading its plain strings.See also: WinAPI, API.

Clipper

Malware that watches the system clipboard and swaps a copied cryptocurrency wallet address for one the attacker owns, so the victim's payment lands in the wrong wallet.

Crypter

A tool used to encrypt a malware binary so antivirus scanners do not recognize its bytes on disk, adding a small PE stub (PE, Portable Executable) that decrypts and launches the payload in memory at run time.See also: PE stub, PE, Payload.

Cryptominer

Malware that uses the victim's processor or graphics card to mine cryptocurrency for the attacker, often the privacy coin Monero using XMRig (an open-source cryptocurrency mining program). It is also called a miner, and using someone else's machine this way is called "cryptojacking".

DDoS

Distributed denial of service: flooding a target server or network with traffic from many infected machines at once so legitimate users cannot reach it. Botnets often rent out this capability as a paid service.See also: Botnet.

Dead drop resolver

A technique where malware fetches its real C2 (command and control, the server that gives the malware orders) address from a legitimate public service, such as a social media profile, a paste site or a code-hosting page, instead of hard-coding it. The attacker can move the C2 server just by editing that page, and the lookup looks like an ordinary visit to a well-known site.See also: C2 / C&C.

Debugger

A Windows debugging program such as x64dbg (for 64-bit binaries), x32dbg (for 32-bit binaries) or WinDbg (Microsoft Windows Debugger) that lets an analyst run a program step by step, pause at breakpoints and inspect or change registers and memory while the code executes.See also: Breakpoint, Register.

Decompiler

A tool that translates low-level machine instructions or bytecode back into higher-level source-like code, such as the C programming language or the AutoIt scripting language, so an analyst can read program logic faster than raw disassembly.See also: Disassembler.

Disassembler

A tool such as IDA Pro (Interactive DisAssembler), Ghidra or Binary Ninja that translates compiled machine bytes (opcodes) back into human-readable assembly instructions. Analysts use it to study a binary without running it.See also: Opcode.

DLL

Dynamic Link Library: a shared library file on Windows that lists its exported functions in an export table for other programs to call. Core operating system features live in system DLLs such as kernel32.dll (memory, file and process management) and ntdll.dll (low-level Windows kernel interface), and malware often loads or injects its own DLLs into running processes.See also: Export table.

Dropper

A program that carries a hidden payload inside its own file or resources and writes or injects that payload onto the victim machine when run.See also: Payload.

Entropy

A measure of how random a block of bytes looks, on a scale from 0 to 8 bits per byte. Packed or encrypted sections have high entropy close to 8 because compression and encryption remove repeating byte patterns.See also: Packer.

Export table

A directory inside a Windows PE (Portable Executable) file or DLL (Dynamic Link Library) that lists the functions it makes available to other modules, along with their names, ordinals (numeric table positions) and RVAs (Relative Virtual Addresses). Malware often walks the export table of system DLLs in memory to find API (Application Programming Interface) addresses by hand.See also: PE, DLL, RVA, API.

Hash

A short, fixed-length fingerprint computed from a file's bytes using a digest algorithm such as MD5 (Message Digest 5), SHA-1 (Secure Hash Algorithm 1) or SHA-256 (256-bit Secure Hash Algorithm). The same file always gives the same hash, so it is the standard IOC (indicator of compromise) used to name, share and look up a sample without passing the file itself around.See also: IOC.

Heuristic

A rule of thumb or pattern check that spots suspicious file structure or runtime behaviour without needing an exact byte match to a known sample.

Hook

Code that intercepts a function call, message or system event before or after the original routine runs. Sandboxes use hooks to log API (Application Programming Interface) calls, and malware uses them to intercept credentials or hide itself.See also: Sandbox, API.

IOC

Indicator of compromise: an observable artefact that suggests a machine is infected, such as a file hash, a domain, an IP (Internet Protocol) address, a Windows Registry key or a mutex name. IOCs are the starting point for detection and threat hunting.See also: Hash, Mutex.

Keylogger

Malware or a module that records keystrokes typed by the victim so the attacker can capture passwords, chat messages and other sensitive text.

Loader

A small piece of malware whose only job is to fetch and start something else: another malware family, a plugin or a fresh payload from the attacker's C2 (command and control) server. Because the payload arrives later, the operator can change what gets installed without infecting the machine again.See also: Payload, C2 / C&C.

Malware analysis

The work of finding out what a suspicious program does: how it starts, what it changes, what it steals or downloads, and who it talks to. It can be static (reading the code and data in a disassembler without running it) or dynamic (running it in a controlled sandbox and watching).See also: Disassembler, Sandbox.

Mutex

A named mutual-exclusion lock object in Windows. Malware often creates one with a fixed name so a second copy can see it is already running and exit. That fixed name then makes a reliable IOC (indicator of compromise, an observable sign of infection).See also: IOC.

Obfuscation

Anything that makes code or data deliberately harder to read without changing what it does: encrypted strings, junk instructions, scrambled control flow or meaningless names. Using a packer is one heavy-handed form of it.See also: Packer.

Opcode

The numeric byte value that tells the processor which operation to perform, such as moving a value, jumping to an address or comparing two registers. Disassemblers turn opcodes and their operands into readable assembly mnemonics.See also: Register, Disassembler.

Packer

A program that compresses or encrypts an executable and adds a small PE stub (PE, Portable Executable) to unpack it in memory at run time. It is used to make the real payload harder to read and to slip past antivirus signatures. "Unpacking" means getting the original executable back.See also: PE stub, PE, Payload, Unpacker.

Panel

The web interface an operator uses to run a malware campaign: it lists infected machines, shows the stolen data and often lets them change the malware's settings. It usually lives on the C2 (command and control, the server that gives the malware orders) server.See also: C2 / C&C.

Payload

The actual malicious code or final program that an attacker wants to run on the victim machine, as opposed to the delivery script, dropper or packer wrapper that carries it there.See also: Dropper, Packer.

PE

Portable Executable: the standard file format for programs, DLLs (Dynamic Link Libraries) and drivers on Windows. A PE file starts with the two-byte MZ header (the initials of Microsoft engineer Mark Zbikowski, placed at the start of Windows executables) and contains sections for code, data, imports, an export table and resources.See also: DLL, Export table.

PE stub

The small outer wrapper inside a packed Windows PE (Portable Executable) file that runs first when the file is launched. Its job is to allocate memory, decrypt or decompress the real payload hidden inside the file, and transfer execution to it.See also: Packer, PE, Payload.

PEB

Process Environment Block: an internal Windows data structure kept inside every running process. It holds the list of loaded DLLs (Dynamic Link Libraries), command-line arguments and a BeingDebugged flag (a one-byte field set to 1 when a debugger is attached), so shellcode and packers read it directly to find system DLLs or run anti-debug checks for a debugger.See also: DLL, Shellcode, Packer, Anti-debug, Debugger.

Persistence

How malware makes sure it starts again after a reboot or logoff, for example with a Windows Registry Run key (a system setting that launches listed programs at sign-in), a scheduled task, a service or a shortcut in the Startup folder.

Process hollowing

An injection technique, also called RunPE (short for "run Portable Executable"), where malware starts a legitimate Windows program in a suspended state, carves out or unmaps its memory, writes a malicious PE (Portable Executable) image in its place, and resumes the thread so the payload runs under a trusted process name.See also: PE, Payload.

Randomizer

A game modding tool that shuffles a game's content (item, enemy and puzzle placements) so every playthrough is different.

RAT

Remote access trojan: a trojan that gives an operator interactive remote control over a victim's machine, often including a command shell, file manager, screen capture and keylogger.See also: Trojan, Keylogger.

RC4

Rivest Cipher 4: a fast, compact stream cipher that generates a pseudo-random byte stream from a key and combines it using XOR (exclusive or, a reversible bitwise operation) with the data. Because the entire algorithm takes only a few dozen instructions, malware authors often use it to encrypt strings, configuration blocks and C2 (command and control, the server that gives the malware orders) traffic.See also: XOR, C2 / C&C.

Register

A tiny, fast storage slot built into the processor, such as EAX and EBX (general-purpose data registers), ESP (the stack pointer) or EIP (the instruction pointer) on 32-bit x86 processors, that holds numbers and memory addresses while machine instructions run.

Reverse engineering

Taking a compiled program apart to recover how it works: reading disassembly or decompiled code, following function calls and renaming routines until the logic is understandable. It is how most of the malware analysis on this site was done.See also: Disassembler, Decompiler, Malware analysis.

RVA

Relative Virtual Address: an offset measured from the base address where a PE (Portable Executable) file is loaded in memory. To get the real memory address at run time, you add the module base address to the RVA.See also: PE.

Sandbox

An isolated, throwaway environment, usually a virtual machine, where a sample can be run and watched safely during malware analysis. Automated sandboxes run the file for you and report what it did.See also: Malware analysis.

Shellcode

A small, position-independent blob of machine code (opcodes) that runs from wherever it is placed in memory, without a PE (Portable Executable) header around it. Packers and loaders often use it to unpack or inject the next stage.See also: Opcode, PE, Packer, Loader.

Stack strings

An obfuscation technique where a program builds a string character by character on the processor stack at run time instead of storing it as a contiguous string in the binary. This keeps the text out of a plain strings scan until the code runs or is opened in a decompiler.See also: Obfuscation, Decompiler.

Stealer

Malware built to collect and send back credentials and personal data to an operator's panel: saved browser passwords, cookies, cryptocurrency wallets, file transfer and email clients, chat sessions and files from the desktop. Also called an infostealer.See also: Panel.

TEA

Tiny Encryption Algorithm: a compact 64-bit block cipher that uses a 128-bit key and a recognizable constant (0x9E3779B9, derived from the golden ratio) inside a simple shift-and-add loop. Malware and packers use TEA and its extended variants XTEA (Extended Tiny Encryption Algorithm) and XXTEA (Corrected Block Tiny Encryption Algorithm) because the code is tiny and easy to inline.See also: Packer.

Trojan

Malware that poses as, or hides inside, something harmless so the victim runs it themselves. The word is used broadly for malware that opens remote access (such as a RAT, remote access trojan) or delivers another payload.See also: RAT, Payload.

UDP

User Datagram Protocol: a connectionless network protocol that sends individual packets without setting up a session or waiting for acknowledgements. Some botnets use UDP for C2 (command and control, the server that gives the malware orders) communication or peer-to-peer traffic to avoid standard connection tracking.See also: Botnet, C2 / C&C.

Unpacker

A script, tool or routine that strips away a packer wrapper and reconstructs the original PE (Portable Executable) file so it can be analyzed cleanly in a disassembler.See also: Packer, PE, Disassembler.

WinAPI

The Windows API (Application Programming Interface): the collection of functions provided by Windows DLLs (Dynamic Link Libraries, such as kernel32.dll for memory, files and processes, and ntdll.dll for low-level system services), including VirtualAlloc (allocates memory), CreateProcess (starts a new process) and WriteProcessMemory (writes bytes into another process).See also: API, DLL.

XOR

Exclusive or: a reversible bitwise operation that undoes itself when applied twice with the same key. Scramble data with XOR and a key once to hide it, and apply XOR with the same key again to get the original bytes back. Malware uses it constantly for lightweight obfuscation of strings and configuration.See also: Obfuscation.

YARA

Yet Another Ridiculous Acronym: a pattern-matching language for files and memory. A YARA rule describes strings or byte sequences that are typical of a malware family, so scanners and analysts during malware analysis can flag matching samples automatically.See also: Malware analysis.