Analyze the malware found in the file Lab05-01.dll using only IDA Pro. The
goal of this lab is to give you hands-on experience with IDA Pro. If you’ve
already worked with IDA Pro, you may choose to ignore these questions and
focus on reverse-engineering the malware.
1. What is the address of DllMain?
0x1000D02E in the .text section
2. Use the Imports window to browse to gethostbyname. Where is the import
0x100163cc in the .idata section
3. How many functions call gethostbyname?
9 times. Note that IDA Pro is showing duplicates per address with different types.
4. Focusing on the call to gethostbyname located at 0x10001757, can you figure
out which DNS request will be made?
pics.praticalmalwareanalysis.com DNS request will be made. If we look at address @0x10001753 we move the pointer 0x10019040 to eax. There are some rubbish text in front of our actual url. but the next instruction will add 13 to pointer. Thus the char* now points to 0x100191A1 which is pics.praticalmalwareanalysis.com.
5. How many local variables has IDA Pro recognized for the subroutine at
23 local variables. Count those with negative offset.
6. How many parameters has IDA Pro recognized for the subroutine at 0x10001656?
One. Count those with positive offset.
7. Use the Strings window to locate the string \cmd.exe /c in the disassembly.
Where is it located?
It is located at 0x10095B34
8. What is happening in the area of code that references \cmd.exe /c?
When we x-ref “\cmd.exe /c” we come to this part of the code.
recv function is called soon after which suggests that the program is waiting for network packets/commands. if we x-ref CommandLine variable. We will see that it is trying to create a process using cmd.exe with Dst being appended to CommandLine variable. This highly suggests that an attacker can connect to the victim and send it with a command to be executed in cmd.exe also commonly known as remote command execution.
9. In the same area, at 0x100101C8, it looks like dword_1008E5C4 is a global
variable that helps decide which path to take. How does the malware set
dword_1008E5C4? (Hint: Use dword_1008E5C4’s cross-references.)
The global variable is set by the following function @ 0x10003695. It will return 1 if the operating system platform is VER_PLATFORM_WIN32_NT;2(according to msdn).
10. A few hundred lines into the subroutine at 0x1000FF58, a series of comparisons
use memcmp to compare strings. What happens if the string comparison
to robotwork is successful (when memcmp returns 0)?
function @ 0x100052A2 will be called with the following key functions
- Open “SOFTWARE\Microsoft\Windows\CurrentVersion” registry key
- Query registry value “WorkTime“
- Send Returned result via send function
- Query registry value “WorkTimes“
- Send Returned result via send function
In short the above function will query “SOFTWARE\Microsoft\Windows\CurrentVersion\WorkTime” & “SOFTWARE\Microsoft\Windows\CurrentVersion\WorkTimes” and send the returned results (integer value) via the network (send function).
11. What does the export PSLIST do?
PSLIST first check if the operating PlatformId is VER_PLATFORM_WIN32_NT;2 and if the windows version is >= windows XP. If it is, it will then check if a string argument is passed in as well. If there is no string being passed in, it will go through all running processes and send it out via the network else it will only send the processes that matches the string that is passed in.
12. Use the graph mode to graph the cross-references from sub_10004E79.
Which API functions could be called by entering this function? Based on
the API functions alone, what could you rename this function?
Based on the graph, we can see that GetSystemDefaultLangId, sprintf, strlen, send, malloc and free are being called. Just be these functions alone we can guess that it is probably trying the get the system default language and send this information across the network. We can rename this function as SendSystemLanguage.
13. How many Windows API functions does DllMain call directly? How many
at a depth of 2?
The graph is a bit too big to be displayed here. But using IDA Pro’s graph view we can see that DLLMain calls strnicmp, strlen, CreateThread directly. At a depth of 2 we can see that strcpy, strchr, strncpy, winexec, gethostbyname, memcpy, sleep, inet_ntoa, strlen, CreateThread, strncmp, ExitThread, FreeLibrary and closesocket are being called.
14. At 0x10001358, there is a call to Sleep (an API function that takes one
parameter containing the number of milliseconds to sleep). Looking
backward through the code, how long will the program sleep if this code
This is simple. The code begins by passing “[This is CTI]30” to eax. It then adds 13 to it. So now eax points to 30. This char* is then converted into integer via atoi function. It is then multiplied by 1000. So now eax contains 30000, which stands for 30000 milliseconds. This value is then passed to the Sleep function. Thus the program will sleep for 30 seconds.
15. At 0x10001701 is a call to socket. What are the three parameters?
According to msdn, socket syntax is as follows
SOCKET WSAAPI socket(
_In_ int af,
_In_ int type,
_In_ int protocol
based on the assembly code, we have af as 2(AF_INET), type as 1(SOCK_STREAM) and protocol as 6(IPPROTO_TCP).
16. Using the MSDN page for socket and the named symbolic constants functionality
in IDA Pro, can you make the parameters more meaningful?
What are the parameters after you apply changes?
17. Search for usage of the in instruction (opcode 0xED). This instruction is
used with a magic string VMXh to perform VMware detection. Is that in use
in this malware? Using the cross-references to the function that executes
the in instruction, is there further evidence of VMware detection?
Searching for 0xED via binary search, we come across this opcode.
Here we find interesting stuff with relation to VMXh; VMware detection.
In the exports liost, we can see 3 install export functions, namely, InstallRT, InstallSA and InstallSB. x-referencing 10006196, we can see that these 3 install functions calls this VM ware detection function. In short on detection of VMWare, the installation will terminates.
18. Jump your cursor to 0x1001D988. What do you find?
Some rubbish random data.
19. If you have the IDA Python plug-in installed (included with the commercial
version of IDA Pro), run Lab05-01.py, an IDA Pro Python script
provided with the malware for this book. (Make sure the cursor is at
0x1001D988.) What happens after you run the script?
20. With the cursor in the same location, how do you turn this data into a
single ASCII string?
Just press on the ‘A‘ key.
21. Open the script with a text editor. How does it work?
It go through 80 bytes and xor each of them with 0x55.