Lab 3-1 Solutions

Short Answers

  1. The malware appears to be packed. The only import is ExitProcess, although the strings appear to be mostly clear and not obfuscated.

  2. The malware creates a mutex named WinVMX32, copies itself into C:\Windows\System32\vmx32to64.exe. and installs itself to run on system startup by creating the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VideoDriver set to the copy location.

  3. The malware beacons a consistently sized 256-byte packet containing seemingly random data after resolving

Detailed Analysis

We begin with basic static analysis techniques, by looking at the malware’s PE file structure and strings. Figure C-1 shows that only kernel32.dll is imported.

Figure C-1. PEview ...

Get Practical Malware Analysis now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.