Practical Malware Analysis

Labs

This chapter’s labs focus on identifying the networking components of malware. To some degree, these labs build on Chapter 13, since when developing network signatures, you’ll often need to deal with encoded content.

Lab 14-1

Analyze the malware found in file Lab14-01.exe. This program is not harmful to your system.

Questions

Q:	1. Which networking libraries does the malware use, and what are their advantages?
Q:	2. What source elements are used to construct the networking beacon, and what conditions would cause the beacon to change?
Q:	3. Why might the information embedded in the networking beacon be of interest to the attacker?
Q:	4. Does the malware use standard Base64 encoding? If not, how is the encoding unusual?
Q:	5. What is the overall purpose ...