Practical Malware Analysis

Lab 14-1 Solutions

Short Answers

1. The program contains the URLDownloadToCacheFile function, which uses the COM interface. When malware uses COM interfaces, most of the content of its HTTP requests comes from within Windows itself, and therefore cannot be effectively targeted using network signatures.

2. The source elements are part of the host’s GUID and the username. The GUID is unique for any individual host OS, and the 6-byte portion used in the beacon should be relatively unique. The username will change depending on who is logged in to the system.

3. The attacker may want to track the specific hosts running the downloader and target specific users.

4. The Base64 encoding is not standard since it uses an a instead of an equal sign (=) for its padding.