2. Practical Malware Analysis Labs

Reverse engineering is an important skill to develop that requires practice. The course textbook provides a plethora of exercises for doing using a number of tools that, while old, are representative of the techniques one would use in modern reverse engineering.

For each lab, a walkthrough in the textbook's appendix describes the process for completing it. For your lab notebook, however, we require that you

Include answers to the questions in this codelab
Include screenshot images for your lab notebook that indicate your completion that contains your OdinID somewhere in the image, when prompted to "show" something. (As your VM should be named with your OdinID, taking the screenshot that includes the name of the window the VM is running within should suffice.)

Lab 1-1

Show the results of virustotal.com. You will need to run this part on a modern system. To do so, download the password-protected zip file located on the course site at: https://thefengs.com/wuchang/courses/cs492/files/Chapter_1L.zip. The password is cs492. Note that if your browser blocks this download, you can perform the download using wget or curl.
In PEView, show the timestamps.
Show the list of imported system library calls. From these calls, what might this executable be doing?
Show the list of imported calls from Lab01-01.dll. From these calls, what might this DLL be doing?
Using PEview, examine the .data section to fiind where the malware is attempting to create its malicious file.

Lab 1-2

Show the results of virustotal.com
In PEView, show the sections that contain the packed executable code
Run UPX (within cygwin shell) to unpack the code and load unpacked executable in PEView
Show the functions imported from Wininet.dll. What might this executable be doing?
Show the URL the malware connects to in memory.

Lab 3-2

Find the functions this DLL exports (Figure 3-5L)
Find the imported functions that are used to modify the registry, create services, and make network connections. Which DLLs are they loaded from?
Use strings within cygwin to reconstruct the URL being requested

Lab 3-4

Copy binary to Desktop and run it. What happens?
Examine the binary's strings using a tool of your choice (such as cygwin's strings) to find the cmd.exe command used
Use Process Monitor (procmon) to monitor events from this binary to generate Figure 3-11L

Lab 5-1 (Steps 1-17 in Appendix C Lab 5-1 Short Answers p. 494)

Use IDA Pro to bring up the code of DllMain
Bring up Figures 5-1L, the equivalent of 5-2L, and 5-3L
Find the remote shell routine in which memcmp() is used to compare command strings received over the network
Show the code for the function called if the command robotwork is invoked
Show IDA Pro graphs of DLLMain and sub_10004E79
Explain what the assembly code on p. 499 does
Find the socket call referred to in Table 5-1L and change its integer constants to symbolic ones
Show the assembly on p. 500. Find the routine that calls this assembly which shows that it is an anti-VM check.

Lab 6-1

Show the imported network functions in any tool
Show the output of executing the binary
Load binary in IDA Pro to generate Figure 6-1L

Lab 6-2

Generate Listing 6-1L and 6-2L using a tool of your choice. What calls hint at this code's function?
Using netcat with Apate DNS redirecting DNS queries to point locally (e.g. 127.0.0.1), execute the malware to generate Listing 6-3L. Note that for the netcat version on cygwin, the -p flag is not required (e.g. nc -l 80 brings up a listener on port 80).
In IDA Pro, show the functions called by main. What does each one do?
In IDA Pro, show the order that the WinINet calls are used and explain what each one does.
Generate Listing 6-5L and explain what each cmp does.

Lab 7-2

Using strings in cygwin, identify the network resource being used by the malware (Note that the resource is encoded in unicode and you will need to pass -e l to the strings command to dump unicode strings instead of ASCII)
What imports give away the mechanism this malware uses to launch the browser?
Go to the code snippet shown on p. 518. Follow the references to show the values of rclsid and riid in memory.
Debug the program in IDA Pro
Set a breakpoint at the call shown on p. 519.
Run the call to show the browser being launched with the embedded URL

Lab 9-2

In OllyDbg, perform the Follow in Dump step to display 1qaz2wsx and ocl.exe
Generate Listing 9-6L in IDA Pro. In OllyDbg, set a breakpoint at the strcmp and identify the strings being compared
In IDA Pro, show where the network calls are located
Change the name of the file to enable the malware to execute
Step through and show the DNS name as it is being decoded
Within Wireshark, show the connect and its result. Note that the site is now a redirect to the book's page on NoStarch.

Lab 11-1

Use strings to identify potential target of malware
Generate Figure 11-1L (Show TGAD section)
Show Resource Hacker extracting TGAD
In IDA Pro, show the routine that performs the extraction
Generate Listing 11-2L in the extracted DLL
Show Listing 11-3L and explain why a jmp is used
Show Listing 11-4L and explain why a call is used
Show Listing 11-5L and explain the purpose of msutil32.sys

Lab 12-1

Show the imports and strings
Rename the three imports (see Listing 12-1L)
Generate Listing 12-2L and explain what its function is
Explain how Listing 12-4L uses what is performed in Listing 12-3L
Use ProcessExplorer to show injection for Figure 12-1L
Generate Listing 12-5L and explain the parameters

Lab 12-3

Show the imports that indicate the program's function
Generate Listing 12-14L and explain what "fn" is
Navigate fn to generate Listing 12-15L (Note: without the Windows SDK installed, you won't be able to redefine the keycodes as shown)
Follow the function called after a "KEYDOWN" event. What does the code in Listing 12-16L do?

Lab 13-1

Show strings output
Show web request listed in Listing 13-1L in Wireshark (turn off promiscuous mode)
In IDA Pro, search for all xor, then bring up Figure 13-1L, rename xorEncode
Bring up xrefs to xorEncode to get to Listing 13-2L
Bring up binary in PEView to find resource section with type and name listed in Listing 13-2L
Install WinHex (winhex.com), open binary, and perform Figure 13-2L
Install PEiD (softpedia.com) with caution (should be a Zip file), open binary, and run KANAL at bottom right arrow to obtain Listing 13-3L
Bring up Figure 13-3L in IDA Pro
From xref to top-level function, bring up and rename base64index function
From xref to base64index, bring up Listing 13-4L
What does the string in the URL being requested represent?

Lab 14-1

Run malware and capture the HTTP request it produces shown in Listing 14-1L. Is it different?
Find the networking API call this malware uses for its request in IDA Pro
Find where the URL string template is stored
Generate Figure 14-1L
Generate Figure 14-2L by redefining data location where string is stored
Locate where the two parts of the URL string are generated (in the %s-%s sprintf)
Map out how the character "6" is generated in the encoded URL
How could malware break the first Snort rule shown?

Lab 15-1

In IDA Pro, what anti-disassembly technique is used and how many times is it used? Undo the anti-disassembly in IDA Pro
What order is the input checked?

Lab 15-2

Explain the false conditional at 0x0040115A. Using the "Edit=>Patch program=>Change Byte" menu, Patch it.
Explain the false conditional at 0x004011D0. Patch it.
Explain the technique being used at 0x00401215. Patch it.
Explain the technique being used at 0x00401269. Patch it.
Explain the technique being used at 0x004012E6. Which two methods does it combine? Patch it to reveal Listing 15-7L.
Step through analysis of the malicious code. What do sub_40130F and sub_401386 do?
Show how the first downloaded file is used to generate the second downloaded file
Show how the second downloaded file is used

Lab 16-1

Load the binary in IDA Pro. Bring up Figure 16-1L and explain what the three jz checks are doing
Bring up sub_401000 and Listing 16-1L. What does this code do?
Load the binary in OllyDbg. Set a breakpoint at 0x00403554. What is the value of eax? Step over several instructions. What happens?
Bring up Figure 16-2L or Figure 16-3L (via the Command Line plug-in or Phant0m plug-in) to reset the flag
Re-run the first OllyDbg step. What happens?
Explain the second anti-debugging check at 0x00403573 and how to bypass it
Explain the third anti-debugging check at 0x00403594 and how to bypass it
As shown in Lab 9-1 (p. 532), use OllyDbg to set the argument to "-in" and single-step to reach 0x004035D5

Lab 17-1

In IDA Pro, show and explain the three anti-VM checks being performed
Run the code. Break before the first anti-VM check. Does this check succeed? If so, NOP or skip the check and run again.
Break before the second anti-VM check. Does this check succeed? If so, NOP or skip the check and run again.
Break before the third anti-VM check by setting a breakpoint at 0x004012CB and stepping into sub_401100. Does this check succeed? If so, NOP or skip the check and run again.
Reach the beginning of malware code at 0x004012DF and generate Listing 17-5L

Lab 18-1

Load executable in IDA Pro to identify packed code
Run PEiD on binary and find section UPX2. Perform a "deep scan". What does PEiD return?
In OllyDbg, locate the jump to the unpacking stub by finding the register save instruction
Set a breakpoint at this location and execute unpacking code. Single-step to the OEP.
Use OllyDump to dump the program into a new executable and load the new executable in IDA Pro

Lab 19-2

In IDA Pro, find the code that opens the registry to find the default web browser
Find the code that attempts to create a new web browser process
Find the place in the code where the browser process is opened and the malicious payload is injected into it and run
Set a breakpoint on main() and run to the breakpoint in IDA Pro. Perform single stepping from there (F8) and see the program execute the code above.
View the buffer containing the shellcode to be injected into the browser (address was found in IDA Pro)
Generate Listing 19-4L

Lab 19-3

Run strings on the PDF file to generate Listing 19-11L
Implement the Python script in Listing 19-12L and generate the shellcode. Does it differ from the included code?
Load shellcode_launcher.exe into IDA Pro or Olly, set arguments to match the command line shown below Listing 19-12L. Find where the shellcode has been loaded and will be launched
Set a breakpoint just before the launch of the shellcode and single-step *into* the call
Where has the code been loaded? Generate Listing 19-13L with these run-time addresses
Single-step through to find the loop that populates the kernel32 API calls

Lab 20-1

In IDA Pro, what does the first subroutine called in WinMain do?
What does the instruction at 0x0401019 do?
What does the instruction at 0x040101C do?
Follow the second subroutine call. What does it do?
What does the instruction at 0x0401055 do?