API Call: IsDebuggerPresent
Jump to navigation
Jump to search
| EMA ID: | ema-1100 |
|---|---|
| Description: | The kernel32!IsDebuggerPresent API call checks the Process Environment Block to see if the calling process is being debugged. This is one of the most basic and common ways of detecting debugging. |
| Associated Behavior: | debugger detect & evade |
| Privilege Level: | User space
|
Inherited Attributes:
| applicable platform: | Windows 10, Windows 7, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2003, Windows Server 2003 SP1, Windows Server 2003 SP2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2008 R2 SP1, Windows Server 2008 SP1, Windows Server 2008 SP2, Windows Server 2012, Windows Server 2012 R2, Windows Vista, Windows Vista SP1, Windows Vista SP2, Windows XP, Windows XP SP1, Windows XP SP2, Windows XP SP3 |
|---|
References:
| Date | Malware Family | URL |
|---|---|---|
| January 27, 2011 | Rebhip | https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html |
