February 2012
Intermediate to advanced
800 pages
23h 55m
English
Content preview from Practical Malware Analysis
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
Labs
Lab 11-1
Analyze the malware found in Lab11-01.exe.
Questions
Q: | 1. What does the malware drop to disk? |
Q: | 2. How does the malware achieve persistence? |
Q: | 3. How does the malware steal user credentials? |
Q: | 4. What does the malware do with stolen credentials? |
Q: | 5. How can you use this malware to get user credentials from your test environment? |
Lab 11-2
Analyze the malware found in Lab11-02.dll. Assume that a suspicious file named Lab11-02.ini was also found with this malware.
Questions
Q: | 1. What are the exports for this DLL malware? |
Q: | 2. What happens after you attempt to install this malware using rundll32.exe? |
Q: | 3. Where must Lab11-02.ini reside in order for the malware to install properly? |
Q: | 4. How is this malware installed for persistence? |
Q: | 5. What user-space ... |