# PMA Chapter 1-04 - Labs

## **Lab 1-4**

This lab uses the file Lab01-04.exe

**Questions**

Upload the Lab01-04.exe file to <http://www.VirusTotal.com/>. Does it match any existing antivirus definitions?

<mark style="background-color:green;">yes, the file was detected by several vendors.</mark>

![](https://4102237612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M7cRwoSIbLIaz6kbFc5%2Fuploads%2F0WopdVF6jGW8j0vB4cUb%2Fimage.png?alt=media\&token=8f538abe-c7c6-4777-99dc-500ec960915d)

Are there any indications that this file is packed or obfuscated? If so, what are these indicators? If the file is packed, unpack it if possible.

<mark style="background-color:green;">When checked with PEiD, there was no indication that it was packed. Likewise, when reviewed with PE-bear, no evidence of packing was identified.</mark>

![](https://4102237612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M7cRwoSIbLIaz6kbFc5%2Fuploads%2FZGWGnl98byUIzPY1E2p9%2Fimage.png?alt=media\&token=4c5172b3-1111-4354-820d-b32b04f2bfb4)

When was this program compiled?

<mark style="background-color:green;">2019/08/30 - 22:26:59 UTC</mark>

![](https://4102237612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M7cRwoSIbLIaz6kbFc5%2Fuploads%2FmQzcgrhFGJBOnVILKqdj%2Fimage.png?alt=media\&token=455220ca-60fc-4c80-9b1f-37f36795189f)

Do any imports hint at this program’s functionality? If so, which imports are they and what do they tell you?

<mark style="background-color:green;">The imports of Kernel32.dll, WinExec and Write File make us think that it creates and executes some file. And it also has functions to work with the processes due to GetProcAddress, GetCurrentProcess and OpenProcess. Regarding advapi32.dll, we can conclude that it treats the access tokens of the processes, which are a token created by the system each time a user logs in and each process executed by that user has a copy of that token.</mark>

![PE-bear output](https://4102237612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M7cRwoSIbLIaz6kbFc5%2Fuploads%2FMEUvkWk0Dgu1DuJUiTMI%2Fimage.png?alt=media\&token=683d3ac6-6497-471c-a6c0-72d6cf35195d)

![PE-bear output 2](https://4102237612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M7cRwoSIbLIaz6kbFc5%2Fuploads%2FccGCtRjNkFQwbYzXHGMc%2Fimage.png?alt=media\&token=212bc073-948d-460a-8914-b47d8c2b5e40)

What host- or network-based indicators could be used to identify this malware on infected machines?

<mark style="background-color:green;"><http://www.practicalmalwareanalysis.com/updater.exe></mark>

![Strings of Lab01-04.exe](https://4102237612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M7cRwoSIbLIaz6kbFc5%2Fuploads%2FLLVQaCNsmKCTJ63oDvAr%2Fimage.png?alt=media\&token=b4271c06-5c7a-4bd4-8e18-b052b279aad4)

This file has one resource in the resource section. Use Resource Hacker to examine that resource, and then use it to extract the resource. What can you learn from the resource?

<mark style="background-color:green;">By reviewing it we can identify that it is the one in charge of downloading the practicalmalwareanalysis.com artifact.</mark>

![Detection of a EXE embedded in .rsrc section of Lab01-04.exe with PE Studio.](https://4102237612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M7cRwoSIbLIaz6kbFc5%2Fuploads%2FVYxyYz8NhNBmYCuVj4DE%2Fimage.png?alt=media\&token=4fba5b18-ba8c-4f69-8f82-a5ea2b2fb958)

![Detection 2 of a EXE embedded in .rsrc section of Lab01-04.exe with PE-Bear.](https://4102237612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M7cRwoSIbLIaz6kbFc5%2Fuploads%2Fn3exnDyWwM7TWg1LpZJr%2Fimage.png?alt=media\&token=8a45e692-1cf1-4ff9-8724-cc9e92f78b70)

![Imports of the Embedded file opened in PE view.](https://4102237612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M7cRwoSIbLIaz6kbFc5%2Fuploads%2Fh0stfOHKN1L071WBgmmD%2Fimage.png?alt=media\&token=b999c297-97fc-4cf3-b126-690e33344eda)

![.data section of the Embedded file opened in PE view .](https://4102237612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M7cRwoSIbLIaz6kbFc5%2Fuploads%2FhMTVTh2DTVC9PAUVaN5B%2Fimage.png?alt=media\&token=145cd870-6d91-4b6d-a185-4f0a004e7717)
