Practical Malware Analysis

Lab 1-2 Solutions

Short Answers

1. As of this writing, the file matches 3 of 41 antivirus signatures.

2. There are several indications that the program is packed with UPX. You can unpack it by downloading UPX and running upx –d.

3. After unpacking the file, you’ll see that the most interesting imports are CreateService, InternetOpen, and InternetOpenURL.

4. You should check infected machines for a service called Malservice and for network traffic to http://www.malwareanalysisbook.com/.

Detailed Analysis

When analyzing Lab 1-2 Solutions, we upload the file to VirusTotal.com and see that it matches at least three virus signatures. One antivirus engine identifies it as a malicious downloader that downloads additional malware; the other two identify it as packed malware. ...