Practical Malware Analysis
Lab solutions and notes from the Practical Malware Analysis book.
- PMA
You’ll need a 64-bit computer and a 64-bit virtual machine in order to run the malware for these labs, as well as the advanced version of IDA Pro in
- PMA
The purpose of this first lab is to demonstrate the usage of the this pointer. Analyze the malware in Lab20-01.exe.
- PMA
The purpose of this second lab is to demonstrate virtual functions. Analyze the malware in Lab20-02.exe.
- PMA
This third lab is a longer and more realistic piece of malware. This lab comes with a configuration file named config.dat that must be in the same directory as the lab in order to execute properly. An
- PMA
PMA Lab 19-2: Shellcode Analysis
The file Lab19-02.exe contains a piece of shellcode that will be injected into another process and run. Analyze this file.
- PMA
PMA Lab 19-3: Shellcode Analysis
Analyze the file Lab19-03.pdf. If you get stuck and can’t find the shellcode, just skip that part of the lab and analyze file Lab19-03sc.bin using shellcodelauncher.exe.
- PMA
PMA Lab 18-02: Packers and Unpacking
Your goal for the labs in this chapter is simply to unpack the code for further analysis. For each lab, you should try to unpack the code so that other static
- PMA
PMA Lab 18-03: Packers and Unpacking
Your goal for the labs in this chapter is simply to unpack the code for further analysis. For each lab, you should try to unpack the code so that other static
- PMA
PMA Lab 18-04: Packers and Unpacking
Your goal for the labs in this chapter is simply to unpack the code for further analysis. For each lab, you should try to unpack the code so that other static
- PMA
PMA Lab 18-05: Packers and Unpacking
Your goal for the labs in this chapter is simply to unpack the code for further analysis. For each lab, you should try to unpack the code so that other static
- PMA
PMA Lab 17-1: Anti-VM Techniques
Analyze the malware found in Lab17-01.exe inside VMware. This is the same malware as Lab07-01.exe, with added anti-VMware techniques.
- PMA
PMA Lab 17-2: Anti-VM Techniques
Analyze the malware found in the file Lab17-02.dll inside VMware. After answering the first question in this lab, try to run the installation exports
- PMA
PMA Lab 17-3: Anti-VM Techniques
Analyze the malware Lab17-03.exe inside VMware. This lab is similar to Lab12-02.exe, with added anti-VMware techniques.
- PMA
Analyze the malware found in Lab16-01.exe using a debugger. This is the same malware as Lab09-01.exe, with added anti-debugging techniques.
- PMA
Analyze the malware found in Lab16-02.exe using a debugger. The goal of this lab is to figure out the correct password. The malware does not drop a malicious payload.
- PMA
Analyze the malware in Lab16-03.exe using a debugger. This malware is similar to Lab09-02.exe, with certain modifications, including the introduction of
- PMA
PMA Lab 15-1: Anti-Disassembly
Analyze the sample found in the file Lab15-01.exe. This is a command-line program that takes an argument and prints 'Good Job!' if the argument matches the secret code.
- PMA
PMA Lab 15-2: Anti-Disassembly
Analyze the Malware found in file Lab15-02.exe. Correct all anti-disassembly countermeasures before analyzing the binary in order to answer the questions:
- PMA
PMA Lab 15-3: Anti-Disassembly
Analyze the Malware found in the file Lab15-03.exe. At first glance, this binary appears to be a legitimate tool, but it actually contains more functionality than advertised.
- PMA
PMA Lab 14-1: Malware-Focused Network Signatures
Analyze the Malware found in file Lab14-01.exe. This program is not harmful to your system.
- PMA
PMA Lab 14-2: Malware-Focused Network Signatures
Analyze the malware found in file Lab14-02.exe. This malware has been configured to beacon to a hardcoded loopback address in order to prevent it from harming your system, but imagine that it is a har
- PMA
PMA Lab 14-3: Malware-Focused Network Signatures
This lab builds on Lab 14-1. Imagine that this malware is an attempt by the attacker to improve his techniques. Analyze the malware found in file Lab14-03.exe.
- PMA
PMA Lab 12-1: Covert Malware Launching
Analyze the malware found in the file Lab12-01.exe and Lab12-01.dll. Make sure that these files are in the same directory when performing the analysis.
- PMA
PMA Lab 12-3: Covert Malware Launching
Analyze the malware extracted during the analysis of Lab 12-2, or use the file Lab12-03.exe.
- PMA
PMA Lab 11-2: Malware Behaviour
Analyze the malware found in Lab11-02.dll. Assume that a suspicious file named Lab11-02.ini was also found with this malware.
- PMA
PMA Lab 11-3: Malware Behaviour
Analyze the malware found in Lab11-03.exe and Lab11-03.dll. Make sure that both files are in the same directory during analysis.
- PMA
Analyze the Malware found in the file Lab09-01.exe using OllyDbg and IDA Pro to answer the following questions. This Malware was initially analyzed in the Chapter 3 labs using basic static and dynamic
- PMA
Analyze the Malware found in the file Lab09-02.exe using OllyDbg to answer the following questions.
- PMA
Analyze the Malware found in the file Lab09-03.exe using OllyDbg and IDA Pro. This Malware loads three included DLLs (DLL1.dll, DLL2.dll, and DLL3.dll) that are all built to request the same memory lo
- PMA
Analyze the malware found in the file Lab05-01.dll using only IDA Pro. The goal of this lab is to give you hands-on experience with IDA Pro. If you’ve already worked with IDA Pro, you may choose to ig
- PMA
PMA Lab 7-1: Analyzing Malicious Windows Programs
Analyze the Malware found in the file Lab07-01.exe.
- PMA
PMA Lab 7-2: Analyzing Malicious Windows Programs
Analyze the Malware found in the file Lab07-02.exe.
- PMA
PMA Lab 6-1: C Code Constructs in Assembly
In this lab, you will analyze the Malware found in the file Lab06-01.exe.
- PMA
PMA Lab 6-3: C Code Constructs in Assembly
In this lab, we’ll analyze the Malware found in the file Lab06-03.exe.
- PMA
PMA Lab 6-4: C Code Constructs in Assembly
In this lab, we’ll analyze the Malware found in the file Lab06-04.exe.
- PMA
PMA Lab 3-3: Basic Dynamic Analysis
1) What do you notice when monitoring this malware with Process Explorer?
- PMA
PMA Lab 1-1: Basic Static Analysis
1) Upload the files to http://www.VirusTotal.com/ and view the reports. Does either file match any existing antivirus signatures?
- PMA
PMA Lab 1-2: Basic Static Analysis
1) Upload the Lab01-02.exe file to http://www.VirusTotal.com/. Does it match any existing antivirus definitions?
- PMA
PMA Lab 1-3: Basic Static Analysis
1) Upload the Lab01-03.exe file to http://www.VirusTotal.com/. Does it match any existing antivirus definitions?
- PMA
PMA Lab 1-4: Basic Static Analysis
1) Upload the Lab01-04.exe file to http://www.VirusTotal.com/. Does it match any existing antivirus definitions?