Skip to Content
Practical Malware Analysis
book

Practical Malware Analysis

by Michael Sikorski, Andrew Honig
February 2012
Intermediate to advanced
800 pages
23h 55m
English
No Starch Press
Content preview from Practical Malware Analysis

Lab 9-3 Solutions

Short Answers

  1. The import table contains kernel32.dll, NetAPI32.dll, DLL1.dll, and DLL2.dll. The malware dynamically loads user32.dll and DLL3.dll.

  2. All three DLLs request the same base address: 0x10000000.

  3. DLL1.dll is loaded at 0x10000000, DLL2.dll is loaded at 0x320000, and DLL3.dll is loaded at 0x380000 (this may be slightly different on your machine).

  4. DLL1Print is called, and it prints “DLL 1 mystery data,” followed by the contents of a global variable.

  5. DLL2ReturnJ returns a filename of temp.txt which is passed to the call to WriteFile.

  6. Lab09-03.exe gets the buffer for the call to NetScheduleJobAdd from DLL3GetStructure, which it dynamically resolves.

  7. Mystery data 1 is the current process identifier, mystery data 2 is the handle to ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Learning Malware Analysis

Learning Malware Analysis

Monnappa K A
Security in Computing, 6th Edition

Security in Computing, 6th Edition

Charles Pfleeger, Shari Lawrence Pfleeger, Lizzie Coles-Kemp
Evasive Malware

Evasive Malware

Kyle Cucci
The Complete Cybersecurity Bootcamp, 2nd Edition

Publisher Resources

ISBN: 9781593272906Errata Page