Learning Malware Analysis

Example 1 – Analyzing a DLL With No Exports

Whenever a DLL is loaded, its entry point function gets called (which in turn calls its DLLMain function). An attacker can implement malicious functionality (such as keylogging, information stealing, and so on) in the DLLMain function without exporting any functions.

In the following example, the malicious DLL (aa.dll) does not contain any exports, which tells you that, all the malicious functionality may be implemented in its DLLmain function, which will be executed (called from the DLL entry point) when the DLL gets loaded. From the following screenshot, it can be seen that the malware imports functions from wininet.dll (which exports the function related to HTTP or FTP). This indicates that the ...