This is common for malware such as ransomware to prevent files from being encrypted twice. Question 4ĭo any imports hint at what this malware does? If so, which importsĪ: The following imports are interesting to observe: Name of ImportĭLL creates a mutex so that no more then one instance of the service can execute. Lab01-01.exeĪ: There are no indications of packing or obfuscation 2.4. N the screenshot below we can see a reasonable amount of imports for lab01-01.exe that are indicative of it’s behaviour such as CreateFileAĪ: There are no indications of packing or obfuscation 2.3.2. However, inspecting the file’s imports and strings is usually a good indicator as to whether or not a file is obfuscated or packed in anyway. For example using a tool like PEiD that is capable of detecting the signatures of packers like UPX amongst many more. There are a few ways of looking for indications of packing. Lab01-01.dllĪre there any indications that either of these files is packed or obfuscated? All that’s required is dragging-and-dropping into the app for a VTotal submission.įor this I used the neat tool PEStudio to grab the PE file compile timestamps. Does either file match any existing antivirus signatures?įor this series I have used the VirusTotalUploader with my own API key to upload the files quickly. Upload the files to and view the reports. I’ll discuss the tools I use and my justification as I come to it in the labs. Note, I’ll mostly be using different tools to that of the book for efficiency, practice and to keep things interesting. Welcome to a rolling blog series of my writeups for the Practical Malware Analysis labs that everyone and their mum has done.

Pestudio malware analysis