MALICIOUS SOFTWARE

Complete Study Guide

Definitions • Classifications • Comparisons • Key Points
1. What is Malware?

Malware — A program inserted into a system, usually covertly, with the intent of compromising the confidentiality,
integrity, or availability of the victim's data, applications, or operating system, or otherwise annoying / disrupting the
victim.

2. Malware Terminology — Quick Reference

Term Description

Advanced Persistent Cybercrime targeting business/political targets using varied intrusion tech, applied persistently; often
Threat (APT) state-sponsored.

Adware Advertising integrated into software; may cause pop-ups or browser redirects.

Attack Kit Tools for auto-generating new malware with various propagation/payload options.

Auto-rooter Malicious tools used to break into new machines remotely.

Backdoor (Trapdoor) Bypasses normal security checks; allows unauthorized access to a program or system.

Downloaders Code that installs other malware on an attacked machine; often the first payload installed.

Drive-by-download Exploits browser vulnerability via compromised website code when the site is viewed.

Exploits Code targeting a specific vulnerability or set of vulnerabilities.

Flooders (DoS) Generates large data volumes to carry out denial-of-service attacks.

Keyloggers Captures keystrokes on a compromised system.

Logic Bomb Dormant code triggered by a predefined condition to carry out an unauthorized act.

Macro Virus Uses macro/scripting code in a document; triggers and replicates when document is opened/edited.

Mobile Code Scripts/macros that can be shipped unchanged across platforms and execute identically.

Rootkit Hacker tools deployed after gaining root-level access to a system.

Spammer Programs Used to send large volumes of unwanted e-mail.

Spyware Collects info (keystrokes, screen data, files) and transmits it to another system.

Trojan Horse Appears useful but hides a malicious function; exploits legitimate authorizations.

Virus Replicates itself into other executable code; executes secretly with the host program.

Worm Runs independently; propagates a full copy of itself to other hosts via vulnerabilities.

Zombie / Bot Activated on an infected machine to launch attacks on other machines.

3. Broad Classification of Malware
Malware is classified along TWO dimensions:

PROPAGATION PAYLOAD / ACTIONS

HOW it spreads to reach targets WHAT it does once it arrives

• Virus infection of executable content • Exploit of software • Corruption of system / data files • Theft of service →
vulnerabilities (worms, drive-by) • Social engineering (trojans, zombie/botnet • Theft of information (keyloggers, spyware) •
phishing) Stealthing — hiding from detection • Blended attacks (multiple
methods)

4. Viruses — Deep Dive

4a. Virus Components (Structure)

Component Description Also Known As

Infection Mechanism How the virus spreads/replicates Infection vector

Trigger Event/condition that activates the payload Logic bomb

Payload The action performed; may be harmless or destructive Mean action

4b. Virus Life-Cycle Phases (in order)

1. Dormant Virus is idle; not all viruses have this stage.

Places a copy into other programs or disk areas. Copy may differ from original. Each infected program
2. Propagation becomes a new propagation source.

3. Triggering Activated by a system event to perform its intended function.

4. Execution The payload runs — may be harmless or destructive.

4c. Virus Target Categories

Boot Sector File Infector Macro Virus Multipartite Virus
Infector

Infects master boot record; Infects executable files Infects docs containing Infects files in multiple ways
spreads when system boots recognised by the OS or shell. macro/scripting code; triggers (combines categories).
from infected disk. on open/edit.
4d. Virus Concealment Strategies — Comparison Table
Type How it Hides Key Weakness for Defender

Encrypted Virus Encrypts body with a random key each time; Decryption stub is constant — scanners can target it.
decrypts at runtime.

Stealth Virus Hides entire virus using rootkit / compression Behaviour-based detection can still catch it.
techniques.

Polymorphic Virus Mutates code with every infection — no constant Signature-based AV cannot detect it; heuristics
bit pattern. needed.

Metamorphic Virus Completely rewrites itself at each iteration; may Hardest to detect; requires deep code analysis.
change behaviour.

4e. Macro & Scripting Viruses — Key Points

• Very common in mid-1990s; now largely countered by AV software.
• Platform-independent — infect documents, not executables.
• Exploit macro capability of MS Office applications.
• Spread easily via shared documents, email attachments.
• Newer Office releases include built-in macro protection.

5. Worms — Deep Dive

5a. Core Characteristics

• Actively seeks out machines to infect — each infected machine becomes a launch pad.
• Exploits software vulnerabilities in client or server programs.
• Spreads over network connections OR via shared media (USB, CD/DVD).
• E-mail worms spread via macro/script code in attachments.
• Usually carries a payload once installed.
• First known implementation: Xerox Palo Alto Labs, early 1980s.

5b. Worm Replication Methods

Method How it Works

Email / Instant Messenger E-mails a copy to other systems or sends itself as an attachment.

File Sharing Copies itself or infects a file on removable media.

Remote Execution Executes a copy of itself directly on another system.

Remote File Access/Transfer Uses file-transfer services to copy itself across systems.

Remote Login Logs onto a remote system as a user and copies itself via commands.

5c. Worm Scanning Strategies

Strategy Mechanism Advantage / Risk

Random Each host probes random IPs with a different seed. Simple but generates high traffic — detectable.

Hit-list Attacker pre-compiles a list of vulnerable machines; Very short scanning window — hard to detect.
infected machines share/scan portions.

Topological Uses data on the infected victim (address books, host Targeted and quiet; lower network noise.
tables) to find next targets.
5d. Worm Technology Features
Feature Description

Multiplatform Attacks a variety of OS/platforms.

Multi-exploit Uses multiple exploit methods: web servers, browsers, email, file sharing, shared media.

Ultrafast Spreading Optimises spread rate to infect maximum machines in minimum time.

Polymorphic Generates new code on-the-fly to evade signature detection.

Metamorphic Has a repertoire of behaviour patterns unleashed at different propagation stages.

Transport Vehicles Ideal carriers for wide deployment of malicious payloads across many machines.

Zero-day Exploit Exploits unknown vulnerabilities — discovered by the community only when the worm launches.
6. Virus vs. Worm — Key Comparison

Aspect Virus Worm

Independence Needs a host program to attach to Runs independently — no host needed

Propagation Spreads when infected file is executed or shared Actively scans and infects new machines over
network/media

Replication target Other executables / documents Other hosts on the network

User interaction Usually requires user to run infected file Largely automated — minimal or no user
interaction

Origin (historical) Older concept; pre-dates worms First implemented at Xerox PARC, early 1980s

Phases Dormant → Propagation → Triggering → Same four phases

Execution

Detection Signature scanning, heuristic analysis Network traffic anomaly detection, IDS

7. Advanced Persistent Threats (APTs)

7a. APT Characteristics Breakdown

Component What it Means

ADVANCED Attackers use a wide variety of intrusion technologies and malware tools.

PERSISTENT Determined, extended campaigns against a chosen target; multiple attack types applied progressively
until compromise.

THREAT Organised, capable, well-funded attackers (often state-sponsored). Active human involvement greatly
raises the threat level.

7b. How APTs Differ from Regular Attacks

• Carefully selected, high-value targets (businesses, governments, critical infrastructure).
• Applied persistently over an extended period — not a one-time hit.
• Often attributed to state-sponsored organisations and criminal enterprises.
• Combine multiple intrusion technologies and malware types in one campaign.
• Active human operators guide and adjust the attack — not fully automated.

8. Payload Actions Summary

Payload Action Description

File Corruption Corrupts or destroys system or data files.

Zombie / Botnet Theft of service — turns system into a remote-controlled attack agent.

Information Theft Steals logins, passwords, personal data via keyloggers or spyware.

Stealthing Hides malware presence from detection/blocking tools.

Blended Attack Uses multiple infection/propagation methods to maximise contagion speed and severity.
9. Exam Quick-Review — Key Points to Remember

1 Malware = Confidentiality + Integrity + Availability threat.

2 Two classification axes: (1) Propagation method, (2) Payload/action.

3 Virus NEEDS a host; Worm is SELF-CONTAINED and runs independently.

4 Virus phases: Dormant → Propagation → Triggering → Execution (not all have Dormant).

5 Virus components: Infection Mechanism + Trigger (logic bomb) + Payload.

6 Encrypted virus: different key per copy — no constant bit pattern for AV.

7 Stealth virus: hides entire virus (not just payload) using rootkit/compression.

8 Polymorphic: mutates code per infection → signature detection fails.

9 Metamorphic: rewrites itself completely + may change behaviour.

1
Worm scanning strategies: Random (noisy), Hit-list (fast/quiet), Topological (uses victim data).
0

1
Morris Worm (1988, Robert Morris) = earliest significant worm; targeted UNIX.
1

1
Zero-day exploit = unknown vulnerability; discovered only when the worm launches.
2

1
APT: state-sponsored / criminal; careful target selection; persistent over time.
3

1
Logic Bomb = dormant code triggered by a predefined condition.
4

1
Backdoor = bypasses normal security; allows unauthorized access.
5

1
Rootkit = tools deployed AFTER gaining root-level access.
6

1
Spyware vs Keylogger: Spyware is broader (network traffic, files); Keylogger captures keystrokes only.
7

1
Blended attack = multiple propagation/infection methods combined.
8

1
Macro viruses: platform-independent, infect documents, mid-1990s peak.
9

2
APT differs from regular attacks by: careful target selection + persistence + human operators.
0

Malicious Software — Study Guide | Based on Lecture 6