Learning Malware Analysis

3.9.1 Example – Determining Files Accessed by Malware

In the previous chapter, while discussing IDAPython, we wrote an IDAPython script to determine all of the cross-references to the CreateFileA function (the address where CreateFileA was called). In this section, let's enhance that script to perform debugging tasks and determine the name of the file created (or opened) by the malware.

The following script sets a breakpoint on all of the addresses where CreateFileA is called within the program, and runs the malware. Before running the following script, the appropriate debugger is selected (Debugger | Select debugger | Local Windows debugger). When this script is executed, it pauses at each breakpoint (in other words, before calls to CreateFileA ...