Lab 9-2 (1)

docx

School

Florida International University *

*We aren’t endorsed by this school

Course

4804

Subject

Information Systems

Date

Apr 3, 2024

Type

docx

Pages

Uploaded by ProfessorMetal2935

Lab 9-2 Analyze the malware found in the file Lab09-02.exe using OllyDbg to answer the following questions. Questions 1. What strings do you see statically in the binary?

2. What happens when you run this binary? The program instantly closes 3. How can you get this sample to run its malicious payload? Renaming it to ocl.exe 4. What is happening at 0x00401133?

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

string were being passed as one by one characters, so we couldn’t see them in string view, the strings were 1qaz2wsz3edc, ocl.exe 5. What arguments are being passed to subroutine 0x00401089? a. Strin 1qaz2wx3edc and a pointer are passed to 0x401089 6. What domain name does this malware use? www.practicalmalwareanalysis.com 7. What encoding routine is being used to obfuscate the domain name? The malware encodes the DNS with XOR 8. What is the significance of the CreateProcessA call at 0x0040106E?

Sets up cmd to showWindow = 0 so the user won notice the reverse shell being accessed

Lab 9-2 (1)

Related Documents