Category: Malware Analysis and Reverse Engineering
Difficulty: Easy/Medium/Hard
File:- PracticalMalwareAnalysis-Labs.tar.gz

1. Basic Static Techniques#

Lab 1-1#

1. Upload the files to http://www.VirusTotal.com/ and view the reports. Does either file match any existing antivirus signatures?#

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
2
└─$ sha256sum Lab01-01.exe
3
58898bd42c5bd3bf9b1389f0eee5b39cd59180e8370eb9ea838a0b327bd6fe47  Lab01-01.exe
4

5
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
6
└─$ sha256sum Lab01-01.dll
7
f50e42c8dfaab649bde0398867e930b86c2a599e8db83b8260393082268f2dba  Lab01-01.dll

Lab01-01.exe
Code insights:
- The sample is a file infector and system hijacker that employs DLL search order hijacking through typosquatting.
- It copies a malicious payload Lab01-01.dll to '%WINDIR%\System32\kerne132.dll' (mimicking the legitimate kernel32.dll).
- The malware then recursively scans the C: drive for executable files (.exe) and modifies their PE headers, specifically patching the Import Address Table (IAT) to replace references to ‘kernel32.dll’ with the malicious kerne132.dll.
- This ensures the malicious library is loaded whenever infected applications are executed.

Pasted image 20260202125936.png

Lab01-01.dll (kerne132.dll)

Pasted image 20260202125958.png

2. When were these files compiled?#

We can see these info inside the details tab of VT,
Lab-01-01.exe

1
Creation Time: 2010-12-19 16:16:19 UTC
2
First Seen In The Wild: 2012-01-08 02:19:06 UTC
3
First Submission: 2012-02-16 07:31:54 UTC
4
Last Submission: 2026-02-02 07:25:44 UTC
5
Last Analysis: 2026-02-01 03:58:36 UTC

Lab-01-01.dll

1
Creation Time: 2010-12-19 16:16:38 UTC
2
First Seen In The Wild: 2010-12-19 09:16:38 UTC
3
First Submission: 2011-07-04 19:57:48 UTC
4
Last Submission: 2026-02-02 07:27:31 UTC
5
Last Analysis: 2026-01-31 11:23:05 UTC

3. Are there any indications that either of these files is packed or obfuscated. If so, what are these indicators?#

We can use Detect it Easy (DiE) for this task, it has entropy section which shows the randomness of each section, which can be indicators to see obfuscation.
Lab-01-01.exe (Not Packed)

Pasted image 20260202130832.png

Pasted image 20260202130900.png

Lab 01-01.dll (Not Packed)

Pasted image 20260202131148.png

Pasted image 20260202131207.png

4. Do any imports hint at what this malware does? If so, which imports are they?#

To see imports we can use pestudio,
Lab-01-01.exe
- Imports = Windows API functions that the program calls from DLLs (like KERNEL32.dll).

1
Start
2
 └─► CopyFileA()
3
      └─► Drop malicious DLL
4
           "Lab01-01.dll"
5
           ↓
6
           "%WINDIR%\\System32\\kerne132.dll"
7
 └─► FindFirstFileA("C:\\*")
8
      └─► FindNextFileA()
9
           ├─► If directory
10
           │     └─► Recurse (FindFirstFileA)
11
           └─► If *.exe
12
                 └─► CreateFileA(target.exe)
13
                      └─► CreateFileMappingA()
14
                           └─► MapViewOfFile()
15
                                └─► Parse PE headers
16
                                     └─► Locate Import Table
17
                                          └─► Replace:
18
                                               "kernel32.dll"
19
                                               ↓
20
                                               "kerne132.dll"
21
                                └─► UnmapViewOfFile()
22
                      └─► CloseHandle()
23
      └─► Repeat until no files left
24
 └─► FindClose()
25
End

Pasted image 20260202131504.png

Lab-01-01.dll

1
DLL Loaded (via infected EXE)
2
 └─► DllMain(DLL_PROCESS_ATTACH)
3
      └─► CreateMutexA()
4
           └─► OpenMutexA()
5
                └─► Ensure single instance (avoid double execution)
6
      └─► Sleep()
7
           └─► Timing / sandbox evasion
8
      └─► WSAStartup()
9
           └─► Initialize Winsock
10
      └─► socket()
11
           └─► Create TCP socket
12
      └─► inet_addr()
13
           └─► Convert hardcoded IP address
14
      └─► htons()
15
           └─► Convert hardcoded port
16
      └─► connect()
17
           └─► Connect to remote C2 server
18
      └─► send()
19
           └─► Transmit host data / beacon
20
      └─► recv()
21
           └─► Receive attacker commands / response
22
      └─► shutdown()
23
           └─► Graceful connection close
24
      └─► closesocket()
25
           └─► Release socket
26
      └─► WSACleanup()
27
           └─► Cleanup Winsock
28
      └─► CreateProcessA()
29
           └─► Execute command or spawn process
30
      └─► CloseHandle()
31
End

Pasted image 20260202132510.png

5. Are there any other files or host-based indicators that you could look for on infected systems?#

Examining the strings contained within Lab01-01.exe more closely reveals that it is referencing a file called C:\windows\system32\kerne132.dll.
This is a very subtle misspelling of the legitimate Kernel32.dll file (notice the use of 1 instead of l) because of this it is likely malicious and we are able to use this to search for infected systems.
I used floss tool for strings analysis,

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
2
└─$ /opt/floss Lab01-01.exe
3

4
INFO: floss: extracting static strings
5
finding decoding function features: 100%|██████████████| 13/13 [00:00<00:00, 1565.44 functions/s, skipped 1 library functions (7%)]
6
INFO: floss.stackstrings: extracting stackstrings from 9 functions
7
extracting stackstrings: 100%|███████████████████████████████████████████████████████████████| 9/9 [00:00<00:00, 55.13 functions/s]
8
INFO: floss.tightstrings: extracting tightstrings from 0 functions...
9
extracting tightstrings: 0 functions [00:00, ? functions/s]
10
INFO: floss.string_decoder: decoding strings
11
emulating function 0x401951 (call 1/1): 100%|████████████████████████████████████████████████| 9/9 [00:01<00:00,  5.48 functions/s]
12
INFO: floss: finished execution after 6.46 seconds
13
INFO: floss: rendering results
14

15

16
FLARE FLOSS RESULTS (version v3.1.1-0-g3cd3ee6)
17

18
+------------------------+------------------------------------------------------------------------------------+
19
| file path              | Lab01-01.exe                                                                       |
20
| identified language    | unknown                                                                            |
21
| extracted strings      |                                                                                    |
22
|  static strings        | 71 (648 characters)                                                                |
23
|   language strings     |  0 (  0 characters)                                                                |
24
|  stack strings         | 0                                                                                  |
25
|  tight strings         | 0                                                                                  |
26
|  decoded strings       | 0                                                                                  |
27
+------------------------+------------------------------------------------------------------------------------+
28

29
.
30
.
31
.
32
CloseHandle
33
UnmapViewOfFile
34
IsBadReadPtr
35
MapViewOfFile
36
CreateFileMappingA
37
CreateFileA
38
FindClose
39
FindNextFileA
40
FindFirstFileA
41
CopyFileA
42
.
43
.
44
.
45
KERNEL32.dll
46
malloc
47
exit
48
MSVCRT.dll
49
.
50
.
51
.
52
kerne132.dll
53
kernel32.dll
54
.exe
55
C:\*
56
C:\windows\system32\kerne132.dll
57
Kernel32.
58
Lab01-01.dll
59
C:\Windows\System32\Kernel32.dll
60
WARNING_THIS_WILL_DESTROY_YOUR_MACHINE
61

62
+------------------------------------+
63
| FLOSS STATIC STRINGS: UTF-16LE (4) |
64
+------------------------------------+
65

66
@jjj
67
@jjj
68
@jjj
69
@jjj
70

71
 ─────────────────────────
72
  FLOSS STACK STRINGS (0)
73
 ─────────────────────────
74

75
 ─────────────────────────
76
  FLOSS TIGHT STRINGS (0)
77
 ─────────────────────────
78

79
 ───────────────────────────
80
  FLOSS DECODED STRINGS (0)
81
 ───────────────────────────

So this is the C:\windows\system32\kerne132.dll which is loaded so this can be another indicator in host system.

6. What network-based indicators could be used to find this malware on infected machines?#

Lab-01-01.dll
Examining the strings contained within Lab01-01.dll more closely reveals that there is what appears to be an IP address.
Because of this and the network imports, it is highly likely that this DLL contacts this IP address, and as such we are able to use this to find infected systems which have contacted 127.26.152.13.

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
2
└─$ /opt/floss Lab01-01.dll
3

4
INFO: floss: extracting static strings
5
finding decoding function features: 100%|███████████████| 5/5 [00:00<00:00, 2200.12 functions/s, skipped 2 library functions (40%)]
6
INFO: floss.stackstrings: extracting stackstrings from 1 functions
7
extracting stackstrings: 100%|███████████████████████████████████████████████████████████████| 1/1 [00:00<00:00, 40.17 functions/s]
8
INFO: floss.tightstrings: extracting tightstrings from 0 functions...
9
extracting tightstrings: 0 functions [00:00, ? functions/s]
10
INFO: floss.string_decoder: decoding strings
11
emulating function 0x10001010 (call 1/1): 100%|██████████████████████████████████████████████| 1/1 [00:00<00:00, 60.43 functions/s]
12
INFO: floss: finished execution after 4.67 seconds
13
INFO: floss: rendering results
14

15

16
FLARE FLOSS RESULTS (version v3.1.1-0-g3cd3ee6)
17

18
+------------------------+------------------------------------------------------------------------------------+
19
| file path              | Lab01-01.dll                                                                       |
20
| identified language    | unknown                                                                            |
21
| extracted strings      |                                                                                    |
22
|  static strings        | 37 (301 characters)                                                                |
23
|   language strings     |  0 (  0 characters)                                                                |
24
|  stack strings         | 0                                                                                  |
25
|  tight strings         | 0                                                                                  |
26
|  decoded strings       | 0                                                                                  |
27
+------------------------+------------------------------------------------------------------------------------+
28

29

30
 ───────────────────────────
31
  FLOSS STATIC STRINGS (37)
32
 ───────────────────────────
33

34
+----------------------------------+
35
| FLOSS STATIC STRINGS: ASCII (37) |
36
+----------------------------------+
37

38
!This program cannot be run in DOS mode.
39
Rich
40
.text
41
`.rdata
42
@.data
43
.
44
.
45
.
46
CloseHandle
47
Sleep
48
CreateProcessA
49
CreateMutexA
50
OpenMutexA
51
KERNEL32.dll
52
WS2_32.dll
53
.
54
.
55
.
56
exec
57
sleep
58
hello
59
127.26.152.13
60
.
61
.
62
.
63
+------------------------------------+
64
| FLOSS STATIC STRINGS: UTF-16LE (0) |
65
+------------------------------------+
66

67
 ─────────────────────────
68
  FLOSS STACK STRINGS (0)
69
 ─────────────────────────
70

71
 ─────────────────────────
72
  FLOSS TIGHT STRINGS (0)
73
 ─────────────────────────
74

75
 ───────────────────────────
76
  FLOSS DECODED STRINGS (0)
77
 ───────────────────────────

7. What would you guess is the purpose of these files?#

Based on the observations above, the executable appears to function primarily as a loader for a malicious DLL that acts as a backdoor or remote access trojan (RAT).
Analysis of its imported functions suggests that the executable checks for the presence of C:\Windows\System32\kerne132.dll and, if absent, copies the malicious DLL to this location to establish persistence.
Once loaded, the DLL likely initiates outbound communication to a command-and-control (C2) server at 127.26.152.13.

Lab 1-2#

1. Upload the Lab01-02.exe file to http://www.VirusTotal.com/. Does it match any existing antivirus definitions?#

Lab-01-02.exe
Code insights
- The binary is a packed (UPX) malware that establishes persistence by installing itself as a Windows service.
- It uses CreateServiceA to create a service named Malservice configured to start automatically.
- It also ensures only a single instance runs by creating a mutex named HGL345.
- Network capabilities are present via InternetOpenUrlA to connect to www[.]malwareanalysisbook[.]com, likely for C2 communication or downloading a next-stage payload.

Pasted image 20260202142416.png

2. Are there any indications that this file is packed or obfuscated? If so, what are these indicators? If the file is packed, unpack it if possible.#

It is packed with UPX which is a popular packer,
As we can see in entropy section, there are 2 section named UPX,
The first UPX section (UPX1) contains the compressed payload, while the second section (UPX2) contains the unpacking stub and runtime code.

Pasted image 20260202142651.png

Pasted image 20260202142802.png

To unpack this file we can use upx itself,

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
2
└─$ upx -d Lab01-02.exe
3
                       Ultimate Packer for eXecutables
4
                          Copyright (C) 1996 - 2024
5
UPX 4.2.4       Markus Oberhumer, Laszlo Molnar & John Reiser    May 9th 2024
6

7
        File size         Ratio      Format      Name
8
   --------------------   ------   -----------   -----------
9
     16384 <-      3072   18.75%    win32/pe     Lab01-02.exe
10

11
Unpacked 1 file.
12

13
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~]
14
└─$ mv Lab01-02.exe Lab01-02.exe.enpacked

Lab-01-02.exe.unpacked,
- Everything is unpacked and we can see all he section.

Pasted image 20260202143250.png

Pasted image 20260202143328.png

3. Do any imports hint at this program’s functionality? If so, which imports are they and what do they tell you?#

Again, we can use pestudio to see imports,

Pasted image 20260202143524.png

1
Start
2
 └─► CreateMutexA()
3
      └─► OpenMutexA()
4
           └─► Ensure single instance
5
 └─► GetModuleFileNameA()
6
      └─► Resolve own executable path
7
 └─► CreateThread()
8
      └─► Run main malicious routine asynchronously
9
 └─► CreateWaitableTimerA()
10
      └─► SetWaitableTimer()
11
           └─► WaitForSingleObject()
12
                └─► Periodic || delayed execution
13
 └─► OpenSCManagerA()
14
      └─► Connect to Service Control Manager
15
 └─► CreateServiceA()
16
      └─► Install malicious service
17
 └─► StartServiceCtrlDispatcherA()
18
      └─► Register service entry point
19
 └─► InternetOpenA()
20
      └─► Initialize WinINet
21
 └─► InternetOpenUrlA()
22
      └─► Connect to remote URL (C2 / payload host)

4. What host- or network-based indicators could be used to identify this malware on infected machines?#

I used floss for strings analysis, - We got the C2 domain, hxxp://www[.]malwareanalysisbook[.]com

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
2
└─$ /opt/floss Lab01-02.exe.unpacked
3

4
INFO: floss: extracting static strings
5
finding decoding function features: 100%|█████████████| 10/10 [00:00<00:00, 4278.59 functions/s, skipped 1 library functions (10%)]
6
INFO: floss.stackstrings: extracting stackstrings from 6 functions
7
extracting stackstrings: 100%|██████████████████████████████████████████████████████████████| 6/6 [00:00<00:00, 167.70 functions/s]
8
INFO: floss.tightstrings: extracting tightstrings from 0 functions...
9
extracting tightstrings: 0 functions [00:00, ? functions/s]
10
INFO: floss.string_decoder: decoding strings
11
emulating function 0x4012c1 (call 1/1): 100%|████████████████████████████████████████████████| 6/6 [00:00<00:00, 58.90 functions/s]
12
INFO: floss: finished execution after 4.92 seconds
13
INFO: floss: rendering results
14

15

16
FLARE FLOSS RESULTS (version v3.1.1-0-g3cd3ee6)
17

18
+------------------------+------------------------------------------------------------------------------------+
19
| file path              | Lab01-02.exe.unpacked                                                              |
20
| identified language    | unknown                                                                            |
21
| extracted strings      |                                                                                    |
22
|  static strings        | 58 (625 characters)                                                                |
23
|   language strings     |  0 (  0 characters)                                                                |
24
|  stack strings         | 0                                                                                  |
25
|  tight strings         | 0                                                                                  |
26
|  decoded strings       | 0                                                                                  |
27
+------------------------+------------------------------------------------------------------------------------+
28

29

30
 ───────────────────────────
31
  FLOSS STATIC STRINGS (58)
32
 ───────────────────────────
33

34
+----------------------------------+
35
| FLOSS STATIC STRINGS: ASCII (55) |
36
+----------------------------------+
37

38
!This program cannot be run in DOS mode.
39
Rich
40
.text
41
`.rdata
42
@.data
43
.
44
.
45
.
46
KERNEL32.DLL
47
ADVAPI32.dll
48
MSVCRT.dll
49
WININET.dll
50
SystemTimeToFileTime
51
GetModuleFileNameA
52
CreateWaitableTimerA
53
ExitProcess
54
OpenMutexA
55
SetWaitableTimer
56
WaitForSingleObject
57
CreateMutexA
58
CreateThread
59
CreateServiceA
60
StartServiceCtrlDispatcherA
61
OpenSCManagerA
62
.
63
.
64
.
65
InternetOpenUrlA
66
InternetOpenA
67
MalService
68
Malservice
69
HGL345
70
http://www.malwareanalysisbook.com
71
Internet Explorer 8.0
72

73

74
+------------------------------------+
75
| FLOSS STATIC STRINGS: UTF-16LE (3) |
76
+------------------------------------+
77

78
@jjjj
79
@jjj
80
@jjj
81

82

83
 ─────────────────────────
84
  FLOSS STACK STRINGS (0)
85
 ─────────────────────────
86

87
 ─────────────────────────
88
  FLOSS TIGHT STRINGS (0)
89
 ─────────────────────────
90

91
 ───────────────────────────
92
  FLOSS DECODED STRINGS (0)
93
 ───────────────────────────

Lab 1-3#

1. Upload the Lab01-03.exe file to http://www.VirusTotal.com/. Does it match any existing antivirus definitions?#

Lab01-03.exe
Code insights
- The sample demonstrates behavior typical of adware or a Trojan-Clicker.
- It initializes OLE/COM and uses CoCreateInstance to instantiate a web browser object (likely IWebBrowser2).
- It then invokes the Navigate method (offset 0x2c) to automatically redirect the user to a hardcoded URL: http://www.malwareanalysisbook.com/ad.html.
- This action is performed without user interaction immediately upon execution.

Pasted image 20260202144919.png

2. Are there any indications that this file is packed or obfuscated? If so, what are these indicators? If the file is packed, unpack it if possible.#

Here is the output of Detect-it-Easy, and entropy show nothing,
- Here is the Breakdown:
  - OS & Architecture: Windows 95/32-bit : just an identification hint, likely the minimum required OS.
  - Language: ASMx86 - compiled from low-level assembly (common in small labs or malware).
  - Protection:
    - Generic[Strange sections + Custom DOS] - unusual PE structure, maybe packed or manually crafted.
  - Packer:
    - Compressed or packed data[Section names repeating] - file is likely packed or obfuscated (maybe UPX or custom packer).

Pasted image 20260202145541.png )

So i used another tool pe-detective and it shows that it FSG v1.00 (Eng) → dulek/xt,
The binary is packed with FSG (Fast Small Good) v1.00, a PE executable packer, written by dulek from the xt (Xtream / Xtreme) group.

Pasted image 20260202145909.png

3. Do any imports hint at this program’s functionality? If so, which imports are they and what do they tell you?#

I used pestudio to see imports, it has only 2.

Pasted image 20260202152401.png

4. What host- or network-based indicators could be used to identify this malware on infected machines?#

It is a future topic that will be covered so for now we pause here.

Lab 1-4#

1. Upload the Lab01-04.exe file to http://www.VirusTotal.com/. Does it match any existing antivirus definitions?#

Lab-01-04.exe
- Code Insights
  - This binary is a downloader.
  - It uses the URLDownloadToFileA function to download an executable from http://www.practicalmalwareanalysis.com/updater.exe.
  - The downloaded file is saved to the system directory as C:\Windows\system32\wupdmgrd.exe and then executed via WinExec.
  - This behavior of downloading and executing a remote payload is unequivocally malicious.

Pasted image 20260202155433.png

2. Are there any indications that this file is packed or obfuscated? If so, what are these indicators? If the file is packed, unpack it if possible.#

This time i used diec which is CLI version of Detect-it-Easy,
- Which shows that it is build using cpp in visual studio.
- And entropy says that it is not packed indeed.

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
2
└─$ diec -u --verbose Lab01-04.exe
3

4
[HEUR/About] Generic Heuristic Analysis by DosX (@DosX_dev)
5
[HEUR] Scanning has begun!
6
[HEUR] Scanning to programming language has started!
7
[HEUR/Any] C library present -> "msvcrt.dll"
8
[HEUR] Scan completed.
9
PE32
10
    Operation system: Windows(95)[I386, 32-bit, GUI]
11
    Linker: Microsoft Linker(6.00.8168)
12
    Compiler: Microsoft Visual C/C++(12.00.8168)[C++/std]
13
    Language: C++
14
    Tool: Visual Studio(6.0)
15

16

17
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
18
└─$ diec Lab01-04.exe -e
19

20
Total 1.17687: not packed
21
  0|PE Header|0|4096|0.671276: not packed
22
  1|Section(0)['.text']|4096|4096|3.12359: not packed
23
  2|Section(1)['.rdata']|8192|4096|1.59136: not packed
24
  3|Section(2)['.data']|12288|4096|0.50793: not packed
25
  4|Section(3)['.rsrc']|16384|20480|0.712982: not packed

3. When was this program compiled?#

For this task i can use readpe which is cli alternative of pestudio,
- Fri, 30 Aug 2019 22:26:59 UTC

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
2
└─$ readpe -H Lab01-04.exe | grep time
3
    Date/time stamp:                 1567204019 (Fri, 30 Aug 2019 22:26:59 UTC)

4. Do any imports hint at this program’s functionality? If so, which imports are they and what do they tell you?#

There is another tool pecli used for which can be used to get PE info like imports etc.

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
2
└─$ pecli info Lab01-04.exe
3

4
Metadata
5
================================================================================
6
...
7

8
Sections
9
================================================================================
10
...
11

12
Imports
13
================================================================================
14
KERNEL32.dll
15
        0x402010 GetProcAddress
16
        0x402014 LoadLibraryA
17
        0x402018 WinExec
18
        0x40201c WriteFile
19
        0x402020 CreateFileA
20
        0x402024 SizeofResource
21
        0x402028 CreateRemoteThread
22
        0x40202c FindResourceA
23
        0x402030 GetModuleHandleA
24
        0x402034 GetWindowsDirectoryA
25
        0x402038 MoveFileA
26
        0x40203c GetTempPathA
27
        0x402040 GetCurrentProcess
28
        0x402044 OpenProcess
29
        0x402048 CloseHandle
30
        0x40204c LoadResource
31
ADVAPI32.dll
32
        0x402000 OpenProcessToken
33
        0x402004 LookupPrivilegeValueA
34
        0x402008 AdjustTokenPrivileges
35
MSVCRT.dll
36
        0x402054 _snprintf
37
        0x402058 _exit
38
        0x40205c _XcptFilter
39
        0x402060 exit
40
        0x402064 __p___initenv
41
        0x402068 __getmainargs
42
        0x40206c _initterm
43
        0x402070 __setusermatherr
44
        0x402074 _adjust_fdiv
45
        0x402078 __p__commode
46
        0x40207c __p__fmode
47
        0x402080 __set_app_type
48
        0x402084 _except_handler3
49
        0x402088 _controlfp
50
        0x40208c _stricmp
51

52

53
Resources:
54
================================================================================
55
...

This is pestudio output because it gives sus potential malicious imports as red flags,

Pasted image 20260202160817.png

Potential Program Flow,
- This executable extracts an embedded payload, writes it to disk, elevates privileges, and executes or injects the payload into another process, indicating a dropper with privilege escalation and injection capabilities.

1
Start
2
 └─► LoadLibraryA()
3
      └─► GetProcAddress()
4
           └─► Dynamically resolve APIs (evasion || flexibility)
5
 └─► FindResourceA()
6
      └─► SizeofResource()
7
           └─► LoadResource()
8
                └─► Extract embedded payload from resources
9
 └─► GetTempPathA()
10
      └─► CreateFileA(temp_file)
11
           └─► WriteFile()
12
                └─► Drop extracted payload to disk
13
 └─► GetWindowsDirectoryA()
14
      └─► MoveFileA()
15
           └─► Relocate payload to Windows directory
16
 └─► OpenProcessToken(GetCurrentProcess())
17
      └─► LookupPrivilegeValueA()
18
           └─► AdjustTokenPrivileges()
19
                └─► Enable elevated privileges
20
 └─► GetCurrentProcess()
21
      └─► OpenProcess()
22
           └─► CreateRemoteThread()
23
                └─► Inject payload into target process
24
 └─► WinExec()
25
      └─► Execute dropped payload
26
 └─► CloseHandle()
27
 └─► ExitProcess()
28
End

5. What host or network-based indicators could be used to identify this malware on infected machines?#

I used floss for strings analysis,
This is the C2 domain which is downloading stage2, hxxp[:]//www[.]practicalmalwareanalysis[.]com/updater[.]exe and it is being put into \system32\wupdmgrd.exe with this name and being executed using WinExec.

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
2
└─$ /opt/floss Lab01-04.exe
3

4
INFO: floss: extracting static strings
5
finding decoding function features: 100%|██████████████| 13/13 [00:00<00:00, 2269.17 functions/s, skipped 1 library functions (7%)]
6
INFO: floss.stackstrings: extracting stackstrings from 8 functions
7
extracting stackstrings: 100%|██████████████████████████████████████████████████████████████| 8/8 [00:00<00:00, 105.67 functions/s]
8
INFO: floss.tightstrings: extracting tightstrings from 0 functions...
9
extracting tightstrings: 0 functions [00:00, ? functions/s]
10
INFO: floss.string_decoder: decoding strings
11
emulating function 0x401701 (call 1/1): 100%|████████████████████████████████████████████████| 8/8 [00:00<00:00, 46.70 functions/s]
12
INFO: floss: finished execution after 4.77 seconds
13
INFO: floss: rendering results
14

15

16
FLARE FLOSS RESULTS (version v3.1.1-0-g3cd3ee6)
17

18
+------------------------+------------------------------------------------------------------------------------+
19
| file path              | Lab01-04.exe                                                                       |
20
| identified language    | unknown                                                                            |
21
| extracted strings      |                                                                                    |
22
|  static strings        | 114 (1210 characters)                                                              |
23
|   language strings     |   0 (   0 characters)                                                              |
24
|  stack strings         | 0                                                                                  |
25
|  tight strings         | 0                                                                                  |
26
|  decoded strings       | 0                                                                                  |
27
+------------------------+------------------------------------------------------------------------------------+
28

29

30
 ────────────────────────────
31
  FLOSS STATIC STRINGS (114)
32
 ────────────────────────────
33

34
+-----------------------------------+
35
| FLOSS STATIC STRINGS: ASCII (114) |
36
+-----------------------------------+
37

38
!This program cannot be run in DOS mode.
39
Rich
40
.
41
.
42
.
43
CloseHandle
44
OpenProcess
45
GetCurrentProcess
46
CreateRemoteThread
47
GetProcAddress
48
LoadLibraryA
49
WinExec
50
WriteFile
51
CreateFileA
52
SizeofResource
53
LoadResource
54
FindResourceA
55
GetModuleHandleA
56
GetWindowsDirectoryA
57
MoveFileA
58
GetTempPathA
59
KERNEL32.dll
60
AdjustTokenPrivileges
61
LookupPrivilegeValueA
62
OpenProcessToken
63
ADVAPI32.dll
64
_snprintf
65
.
66
.
67
.
68
%s%s
69
\winup.exe
70
%s%s
71
!This program cannot be run in DOS mode.
72
Rich
73
.text
74
.
75
.
76
.
77
GetWindowsDirectoryA
78
WinExec
79
GetTempPathA
80
KERNEL32.dll
81
URLDownloadToFileA
82
urlmon.dll
83
.
84
.
85
.
86
\winup.exe
87
%s%s
88
\system32\wupdmgrd.exe
89
%s%s
90
http://www.practicalmalwareanalysis.com/updater.exe
91

92
+------------------------------------+
93
| FLOSS STATIC STRINGS: UTF-16LE (0) |
94
+------------------------------------+
95

96
 ─────────────────────────
97
  FLOSS STACK STRINGS (0)
98
 ─────────────────────────
99

100
 ─────────────────────────
101
  FLOSS TIGHT STRINGS (0)
102
 ─────────────────────────
103

104
 ───────────────────────────
105
  FLOSS DECODED STRINGS (0)
106
 ───────────────────────────

6. This file has one resource in the resource section. Use Resource Hacker to examine that resource, and then use it to extract the resource. What can you learn from the resource?#

In PEstudio, if we inspect resource of this file we can see that it has another exe embedded so we can carve it.
By saving this as a binary (executable) file, we can then run using pecli and see this is the file which not only contains the winexec imported function of kernel32.dll, but also the URLDownloadToFile function of URLMON.DLL which indicates it will likely download and execute a file.

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/~]
2
└─$ file Lab01-04_res.exe
3

4
Lab01-04_res.exe: PE32 executable for MS Windows 4.00 (GUI), Intel i386, 3 sections

1
┌──(b14cky㉿DESKTOP-VRSQRAJ)-[~/]
2
└─$ pecli info Lab01-04_res.exe
3

4
Imports
5
================================================================================
6
...
7
urlmon.dll
8
        0x40204c URLDownloadToFileA
9
...

Pasted image 20260202125985.png