Question

A friend of mine downloaded some malware from Facebook, and I’m curious to see what it does without infecting myself. I know that you can’t really decompile an .exe, but can I at least view it in Assembly or attach a debugger?

Edit to say it is not a .NET executable, no CLI header.

Answer 1

With a debugger you can step through the program assembly interactively.
With a disassembler, you can view the program assembly in more detail.
With a decompiler, you can turn a program back into partial source code, assuming you know what it was written in (which you can find out with free tools such as PEiD – if the program is packed, you’ll have to unpack it first OR Detect-it-Easy if you can’t find PEiD anywhere. DIE has a strong developer community on github currently).

Debuggers:

• OllyDbg, free, a fine 32-bit debugger, for which you can find numerous user-made plugins and scripts to make it all the more useful.
• WinDbg, free, a quite capable debugger by Microsoft. WinDbg is especially useful for looking at the Windows internals, since it knows more about the data structures than other debuggers.
• SoftICE, SICE to friends. Commercial and development stopped in 2006. SoftICE is kind of a hardcore tool that runs beneath the operating system (and halts the whole system when invoked). SoftICE is still used by many professionals, although might be hard to obtain and might not work on some hardware (or software – namely, it will not work on Vista or NVIDIA gfx cards).

Disassemblers:

• IDA Pro(commercial) – top of the line disassembler/debugger. Used by most professionals, like malware analysts etc. Costs quite a few bucks though (there exists free version, but it is quite quite limited)
• W32Dasm(free) – a bit dated but gets the job done. I believe W32Dasm is abandonware these days, and there are numerous user-created hacks to add some very useful functionality. You’ll have to look around to find the best version.

Decompilers:

• Visual Basic: VB Decompiler, commercial, produces somewhat identifiable bytecode.
• Delphi: DeDe, free, produces good quality source code.
• C: HexRays, commercial, a plugin for IDA Pro by the same company. Produces great results but costs a big buck, and won’t be sold to just anyone (or so I hear).
• .NET(C#): dotPeek, free, decompiles .NET 1.0-4.5 assemblies to C#. Support for .dll, .exe, .zip, .vsix, .nupkg, and .winmd files.

Some related tools that might come handy in whatever it is you’re doing are resource editors such as ResourceHacker (free) and a good hex editor such as Hex Workshop (commercial).

Additionally, if you are doing malware analysis (or use SICE), I wholeheartedly suggest running everything inside a virtual machine, namely VMware Workstation. In the case of SICE, it will protect your actual system from BSODs, and in the case of malware, it will protect your actual system from the target program. You can read about malware analysis with VMware here.

Personally, I roll with Olly, WinDbg & W32Dasm, and some smaller utility tools.

Also, remember that disassembling or even debugging other people’s software is usually against the EULA in the very least 🙂