2. Unpacking

What you need:

Purpose

You will practice the techniques in chapter 1.

This project follows Lab 1-2 in the textbook. There are more detailed solutions in the back of the book.

Send the Lab01-02.exe file to VirusTotal. More antivirus products detect this file, as shown below.

Examine the strings in Lab01-02.exe with BinText.

There are only a few strings, and they call only a few ordinary Windows API commands, as shown below.

These strings aren't from the malware--they are from the UPX packer, as we will show below.

Run PEiD on the file. It shows that the file is packed with UPX, as shown in the "EP Section" below.

Run PEview on the file. The file has sections labeled UPX0, UPX1, and UPX2, as shown below.

These are section names produced by the UPX packer.

Open a Command Prompt window and execute this command:

UPX

You see a UPX help message, as shown below:

Execute these commands to move to the directory containing the malware samples, and list the files there:

cd "\Users\Administrator\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_1L"
DIR

You see several malware samples, including Lab01-02.exe, as shown below:

Execute these commands to unpack the file, and list the files again:

UPX -d -o Lab01-02-unpacked.exe Lab01-02.exe
DIR

The unpacked file is much larger than the original file, as shown below:

Analyze the unpacked file with PEiD. It now is regognized as a "Microsoft Visual C++ 6.0" file, as shown below.

Turn in the image showing your analysis of Lab01-02-unpacked.exe as shown below.

We will grade it based on the "First Bytes".

Save this image with the filename "Proj 2b from YOUR NAME".

Find the unpacked file's imports with Dependency Walker.

The imports from KERNEL32.DLL, ADVAPI32.DLL, and MSVCRT.DLL are uninformative generic functions used by almost every program.

However, the WININET.DLL imports are InternetOpenUrlA and InternetOpenA, as shown below. This indicates that the malware connects to a URL.

Find the strings in the unpacked file.

You should see MalService and http://www.malwareanalysisbook.com as shown below.

These suggest that infected machines will connect to http://www.malwareanalysisbook.com and will show a running service named MalService.

Last modified 1-7-19