A. Aho, J. Ullman, and S. Biswas, Principles of Compiler Design, 1977.

L. Auriemma, Signsrch tool

F. Boldewin, Peacomm.c Cracking the nutshell

J. Caballero, P. Poosankam, C. Kreibich, and D. Song, Dispatcher, Proceedings of the 16th ACM conference on Computer and communications security, CCS '09, pp.621-634, 2009.
DOI : 10.1145/1653662.1653737

J. Calvet, C. Davis, and P. Bureau, Malware authors don't learn, and that's good!, 2009 4th International Conference on Malicious and Unwanted Software (MALWARE), pp.88-97, 2009.
DOI : 10.1109/MALWARE.2009.5403013

J. Daemen and V. Rijmen, The design of Rijndael: AES?the advanced encryption standard, 2002.
DOI : 10.1007/978-3-662-04722-4

N. Fallì-ere, Reversing Trojan.Mebroot's Obfuscation, Reverse Engineering Conference (REcon), 2010.

F. Gröbert, C. Willems, and T. Holz, Automated Identification of Cryptographic Primitives in Binary Programs, Proc. Recent Advances in Intrusion Detection (RAID), pp.41-60, 2011.
DOI : 10.1007/978-3-642-04444-1_13

J. Halderman, S. Schoen, N. Heninger, W. Clarkson, W. Paul et al., Lest we remember, Communications of the ACM, vol.52, issue.5, pp.91-98, 2009.
DOI : 10.1145/1506409.1506429

S. Henson, OpenSSL library

J. Hopcroft, R. Motwani, and J. Ullman, Introduction to automata theory, languages, and computation, 2007.
DOI : 10.1145/568438.568455

M. Kobayashi, Dynamic Characteristics of Loops, IEEE Transactions on Computers, vol.33, issue.2, pp.125-132, 1984.
DOI : 10.1109/TC.1984.1676404

I. O. Levin, Draft crypto analyzer (draca)

D. Litzenberger, PyCrypto -The python cryptography toolkit, 2011.

C. Luk, R. Cohn, R. Muth, H. Patil, A. Klauser et al., Pin, ACM SIGPLAN Notices, vol.40, issue.6, pp.190-200, 2005.
DOI : 10.1145/1064978.1065034

N. Lutz, Towards revealing attacker's intent by automatically decrypting network traffic, 2008.

C. Maartmann-moe, S. Thorkildsen, and A. Arnes, The persistence of memory: Forensic identification and extraction of cryptographic keys, Digital Investigation, vol.6, pp.132-140, 2009.
DOI : 10.1016/j.diin.2009.06.002

P. Montgomery, Modular multiplication without trial division, Mathematics of Computation, vol.44, issue.170, pp.519-521, 1985.
DOI : 10.1090/S0025-5718-1985-0777282-X

M. Morgenstern and H. Pilz, Useful and useless statistics about viruses and anti-virus programs, Proc. CARO Workshop, 2010.

L. Murchu, Trojan.silentbanker decryption

R. Rivest, RFC 1321: The MD5 message-digest algorithm, Internet Activities Board, vol.143, 1992.
DOI : 10.17487/rfc1321

R. Rivest, A. Shamir, and L. Adleman, A method for obtaining digital signatures and public-key cryptosystems, Communications of the ACM, vol.21, issue.2, pp.120-126, 1978.
DOI : 10.1145/359340.359342

C. E. Shannon, Communication Theory of Secrecy Systems*, Bell System Technical Journal, vol.28, issue.4, pp.656-715, 1949.
DOI : 10.1002/j.1538-7305.1949.tb00928.x

N. Stewart, Inside the storm: Protocols and encryption of the Storm botnet, Black Hat Technical Security Conference, 2008.

S. Trilling, Project Green Bay -Calling a Blitz on Packers, CIO Digest: Strategies and Analysis from Symantec, 2008.

J. Tubella and A. González, Control speculation in multithreaded processors through dynamic loop detection, Proceedings 1998 Fourth International Symposium on High-Performance Computer Architecture, pp.14-23, 1998.
DOI : 10.1109/HPCA.1998.650542

. Verisign, Silentbanker analysis

C. Wang, J. Hill, J. Knight, and J. Davidson, Software tamper resistance: Obstructing static analysis of programs, 2000.

Z. Wang, X. Jiang, W. Cui, X. Wang, and M. Grace, ReFormat: Automatic Reverse Engineering of Encrypted Messages, Proc. ESORICS, pp.200-215, 2009.
DOI : 10.1016/S1389-1286(99)00112-7

D. Wheeler and R. Needham, TEA, a tiny encryption algorithm, Proc. Fast Software Encryption, pp.363-366, 1995.
DOI : 10.1007/3-540-60590-8_29

V. Zakorzhevsky, A new version of Sality at large. http://www.securelist.com/en/blog

R. Zhao, D. Gu, J. Li, and R. Yu, Detection and Analysis of Cryptographic Data Inside Software, Information Security, vol.6, pp.182-196, 2011.
DOI : 10.1007/3-540-48390-X_9