Practical Malware Analysis

Lab 6-2 Solutions

Short Answers

1. The first subroutine at 0x401000 is the same as in Lab 6-1 Solutions. It’s an if statement that checks for an active Internet connection.

2. printf is the subroutine located at 0x40117F.

3. The second function called from main is located at 0x401040. It downloads the web page located at: http://www.practicalmalwareanalysis.com/cc.htm and parses an HTML comment from the beginning of the page.

4. This subroutine uses a character array filled with data from the call to InternetReadFile. This array is compared one byte at a time to parse an HTML comment.

5. There are two network-based indicators. The program uses the HTTP User-Agent Internet Explorer 7.5/pma and downloads the web page located at: http://www.practicalmalwareanalysis.com/cc.htm ...