Hello,

I was looking in the Signatures files in Clamwin when I saw that amny signatures had EP+n(for n = to a number)
so I looked on the Clamwin signature guide but the explaination that was given did not made much sense to me, would anyone mind to clarify its purpose ?

Thanks

Al968

In some signatures, the "EP + a number" refers to the entry point plus a certain number of bytes. It is used in the *.ndb extended signatures for Windows PE (portable executable) files--the standard Windows file type.

Regards,

Thank You, but actually thats pretty much what it said in the pdf I read.
I would like the translation in standart english

Thanks

Al968

The entry point in the program/application is where processing starts, so in this case, the signature is at the entry point plus a certain indicated number of bytes.

Regards,

ok, very helpful
So If I understand correctly there is no point in using EP+0, is that right ?

Thanks

Al968

EP +0 would take you back to the entry point, which is valid.

Regards,

If you've found a quality signature that occurs at the entrypoint, then it is feasible to use EP+0. However, if you are familiar with compiled programming languages like C. C++, and Pascal, the entrypoint is supplied by the compiler and is usually standard code for that version of the compiler.

For instance, this code


If compiled by visual studio, the entrypoint will be pointing to a function inside of the C runtime called "tmainCRTStartup" which in turn calls your "main" function. So it is atypical to see malware directly at the entrypoint.

You couldn't be more wrong.

Atypical doesn't mean never. I work on malware daily and can say with fair certainty, aside from counting packers as malware, when referencing the ORIGINAL entrypoint, it is typically MSVC startup code.

Yes some malware decides to redirect the entrypoint to their own code, however, in most instances today they do not.

I think EOP manipulation (or any method of obfuscation) depends upon the skill level of the malware writer, or whatever "script" or tools he/she is working with, and where the malware is going to be planted/used.

Regards,

If you are a malware writer without really good skills, you rely upon packing rather than EPO. If you see less entry point obscuring, it's because of that. There are also fads, in malware, as in anything else.

Regards,