Practical Malware Analysis

Lab 7-2 Solutions

Short Answers

1. This program does not achieve persistence. It runs once and then exits.

2. The program displays an advertisement web page to the user.

3. The program finishes executing after displaying the advertisement.

Detailed Analysis

We begin with some basic static analysis. While we don’t see any interesting ASCII strings, we do see one interesting Unicode string: http://www.malwareanalysisbook.com/ad.html. We check the imports and exports of the program, and see only a few imports in addition to the standard imports, as follows:

SysFreeString
SysAllocString
VariantInit
CoCreateInstance
OleInitialize
OleUninitialize

All of these functions are COM-related. The CoCreateInstance and OleInitialize functions in particular are required in order ...