Skip to Content
Practical Malware Analysis
book

Practical Malware Analysis

by Michael Sikorski, Andrew Honig
February 2012
Intermediate to advanced
800 pages
23h 55m
English
No Starch Press
Content preview from Practical Malware Analysis

Lab 13-1 Solutions

Short Answers

  1. Two strings appear in the beacon that are not present in the malware. (When the strings command is run, the strings are not output.) One is the domain, www.practicalmalwareanalysis.com. The other is the GET request path, which may look something like aG9zdG5hbWUtZm9v.

  2. The xor instruction at 004011B8 leads to a single-byte XOR-encoding loop in sub_401190.

  3. The single-byte XOR encoding uses the byte 0x3B. The raw data resource with index 101 is an XOR-encoded buffer that decodes to www.practicalmalwareanalysis.com.

  4. The PEiD KANAL plug-in and the IDA Entropy Plugin can identify the use of the standard Base64 encoding string:

    ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

  5. Standard Base64 encoding is used ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Learning Malware Analysis

Learning Malware Analysis

Monnappa K A
Security in Computing, 6th Edition

Security in Computing, 6th Edition

Charles Pfleeger, Shari Lawrence Pfleeger, Lizzie Coles-Kemp
Evasive Malware

Evasive Malware

Kyle Cucci
The Complete Cybersecurity Bootcamp, 2nd Edition

Publisher Resources

ISBN: 9781593272906Errata Page