Practical Malware Analysis

Lab 6-4 Solutions

Short Answers

1. The function at 0x401000 is the check Internet connection method, 0x401040 is the parse HTML method, 0x4012B5 is printf, and 0x401150 is the switch statement.

2. A for loop has been added to the main method.

3. The function at 0x401040 now takes a parameter and calls sprintf with the format string Internet Explorer 7.50/pma%d. It builds a User-Agent for use during HTTP communication using the argument passed in.

4. This program will run for 1440 minutes (24 hours).

5. Yes, a new User-Agent is used. It takes the form Internet Explorer 7.50/pma%d, where %d is the number of minutes the program has been running.

6. First, the program checks for an active Internet connection. If none is found, the program terminates. Otherwise, the program ...