Technical requirements Setting up the environmentLooking for malware indicatorsLooking for stringsIntelligence information and external sourcesChecking import functionsDissecting interesting malware sample parts The entry point functionAnalyzing the 0x00453340 functionAnalyzing the 0x00453C10 functionAnalyzing the 0x0046EA60 functionAnalyzing the 0x0046BEB0 functionAnalyzing the 0x0046E3A0 functionBy analyzing this function, we notice that the pipe is used for some kind of synchronization. The CreateThread API function receives as parameters the function to execute as a thread and an argument to pass to the function; so, when a thread creation appears, we have to analyze a new function – in this case, lpStartAddress_00449049:Analyzing the 0x004559B0 functionAnalyzing the 0x004554E0 functionAnalyzing the 0x0046C860 functionAnalyzing the 0x0046A100 functionSummaryQuestions Further reading