February 2012
Intermediate to advanced
800 pages
23h 55m
English
Content preview from Practical Malware AnalysisBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
Lab 16-3 Solutions
Short Answers
There aren’t many useful strings in the malware other than import functions and the strings
cmdandcmd.exe.When you run this malware, it appears to do nothing other than terminate.
You must rename the malware to peo.exe for it to run properly.
This malware uses three different anti-debugging timing techniques:
rdtsc,GetTickCount, andQueryPerformanceCounter.If the
QueryPerformanceCountercheck is successful, the malware modifies the string needed for the program to run properly. If theGetTickCountcheck is successful, the malware causes an unhandled exception that crashes the program. If therdtsccheck is successful, the malware will attempt to delete itself from disk.The anti-debugging timing checks are successful ...