PMA Chapter 1-03 - Labs
Labs answers from the book "Practical Malware Analysis". Chapter 1.
Last updated
Was this helpful?
Labs answers from the book "Practical Malware Analysis". Chapter 1.
Last updated
Was this helpful?
This lab uses the file Lab01-03.exe
Questions
Upload the Lab01-03.exe file to http://www.VirusTotal.com/. Does it match any existing antivirus definitions?
yes, the file was detected by several vendors.
Are there any indications that this file is packed or obfuscated? If so, what are these indicators? If the file is packed, unpack it if possible.
When reviewing the file with PEiD we detected that it is packed with FSG 1.0, when reviewing methods to unpack it, the use of OllyDump is mentioned. Due to the fact that it is not in the agenda of the first chapter we will put it as pending.
Do any imports hint at this program’s functionality? If so, which imports are they and what do they tell you?
The functions from kernel32, LoadLibrary and GetProcAddress can be used to retrieve any function located in any library on a system.
What host- or network-based indicators could be used to identify this malware on infected machines?
Since it is not possible to unpack the archive at this time we are unable to answer this question.
