Practical Malware Analysis

Lab 1-3 Solutions

Short Answers

1. As of this writing, 25 of 43 virus engines identify this sample as malware.

2. The file is packed, but we can’t unpack it at this time.

3. This question can’t be answered without unpacking the file.

4. This question can’t be answered without unpacking the file.

Detailed Analysis

For the file Lab01-03.exe, VirusTotal.com reports a variety of different signatures with vague-sounding names. The most common signature is that of a file packed with the FSG packer.

When we open the file in PEview, we see several indications that the file is packed. The first is that the file sections have no names. Next, we see that the first section has a virtual size of 0x3000, but a raw data size of 0. We run PEiD to confirm, and it identifies the ...