Practical Malware Analysis

Lab 3-4 Solutions

Short Answers

1. When you run this malware by double-clicking it, the program immediately deletes itself.

2. We suspect that we may need to provide a command-line argument or a missing component to the program.

3. We try using the command-line parameters shown in the strings listing (like -in), but doing so is not fruitful. More in-depth analysis is required. (We’ll analyze this malware further in the labs for Chapter 9.)

Detailed Analysis

We begin with basic static analysis, examining the PE file structure and strings. We see that this malware imports networking functionality, service-manipulation functions, and registry-manipulation functions. In the following listing, we notice a number of interesting strings.

SOFTWARE\Microsoft \XPS \kernel32.dll ...