Are questions about malware functionality on topic

Question

Are questions about the functionality or workings of malware on topic? This does not include questions about how to reverse engineer malware, but instead asks about specific API calls or functionality that malware may be using.

Note: the "covered" vs "not covered" sections below does not imply that either category should be covered. Instead, it says that if this subject (questions about the functionality of malware) is accepted, then questions similar to the "covered" section would be allowed, whereas questions not covered by this section may not be allowed, because this subject does not apply to them.

Covered by this subject would be these kinds of questions:

• "Why would malware make references to fs[30h]?"
• "What is DLL Load order hijacking?"

Not covered by this subject would be the questions:

• "What is a safe way to run malware for dynamic analysis?"
• "What anti debugging techniques should I look out for?"
• "I need to intercept traffic to a specific IP address, is this possible?"

Answer 1

Not everything about malware is on-topic.

Questions about reverse engineering malware (figuring out what it does, running it safely, etc.) or about techniques used by malware to make reverse engineering difficult are on-topic.

Questions about other aspects of malware, such as how it is spread or how its exploitation components work, are unrelated to reverse engineering. Note that there is another Stack Exchange site, Security, where most aspects of malware are on-topic.

A question like “Why would malware make references to …” isn't a priori on-topic here, as the answer may be something that has nothing to do with reverse engineering difficult (e.g. “this is how it exploits the OS”). I would recommend asking on Security instead.

Answer 2

Yes, questions about malware-specific functionality should be allowed because:

• Malware Analysis and Reverse Engineering are very similar fields. If a separate Malware Analysis SE site was created, it would have to include reverse engineering as a topic but this would cause duplicate question and answers among the two sites.
• Questions about specific malware functionality generally do not fit on any other SE site.
• Malware analysis questions can be easily tagged and ignored by those uninterested.
• The answer to a malware functionality question provides the information that is necessary to reverse engineer malware.