Advanced Static Analysis #2
The second part of the Lab from Chapter 5
8. What is happening at the area of the code that references \cmd.exe /c?
The second level from the top contains the cmd.exe string. The second level determines whether to use cmd.exe or command.exe. I’m not sure why that matters. The green CommandLine is a variable within the stackframe. EBP seems to point to the end of the stack frame.
The recv call in pink stands out and seems to be opening up a socket. Perhaps the malware is trying to start an internet connection to the practical malware URL?
9. In the same area at 0x100101C8, it looks like dword_1008E5C4 is a global variable that decides which path to take how does the malware set dword_10008E5C4?
Look into DATA XREF reveals it takes a OS version information return value from a subroutine.
10. A few hundred lines into the subroutine at 0x1000FF58. A series of comparions use memcmp to compare strings. What happens if the string comparison to robotwork is successful?
Memcmp compares characters in two buffers. Returns 0 if they are identical. Finally found the comparison to robotwork:
We get extended information about the operating system. The program then calls RegOpenKeyA. We query about the work time. Create a string with atoi and sprintf containing the information we queried. Then finally close the key,
11. What does export PSLIST do?
With a simple navigation to PSLIST through the export window. We determine that it takes in 3 ints and a char. It calls a subroutine to check OS version. It will then send over processes that matches the string passed.
12. Use the graph mode to graph the cross-reference from sub_100004E79. Which API function could be called by entering tis function?
Based on the functions that it calls and the knowledge we know of this malware we can say it sends a message.
13. How many API functions does Dllmain call directly?
Dllmain calls stnicmp, strlen and CreateThread directly.
14. At 0x10001358, there is a call to Sleep (an API function that takes one parameter contained the number of millisecond to sleep). How long would it take before the program executes?
You can change hexadecimal to decimal by pressing the values and pressing H! That’s handy! We add 13 onto the address so it points to 30 then we multiply by 1000 to get 30,0000 milliseconds which is 30 seconds.
Reflections
I missed a crucial part of the work times analysis. The registry is opened and the query gains the information. Afterwards, the information is sent over the internet!
I missed a subroutine between the query and close. The subroutine opens a socket and sends data! I learnt a great deal from the practical exercises. However, It was extremely time consuming crawling through the functions. I’ll definitely look more into reverse engineering once the course is over!