PMA Lab 6-1: C Code Constructs in Assembly
In this lab, you will analyze the Malware found in the file Lab06-01.exe.
Lab 6-1
In this lab, you will analyze the Malware found in the file Lab06-01.exe.
1) What is the major code construct found in the only subroutine called by main?
Opening up Lab06-01.exe in IDA we can see that main calls sub_401000:
Going inside this function we can see that it has an if statement:
As with any if, depending on the condition the program either takes one branch or the other, in this case, the condition is the result of InternetGetConnectedState.
2) What is the subroutine located at 0x40105F?
Subroutine 0x40105F is a “printf” function that will print a message of the connection status. This subroutine isn’t automatically identified by IDA.
3) What is the purpose of this program?
This program only uses InternetGetConnectedState in order to retrieve the connected state of the local system and then calls the “printf” function in order to print a message (depending on the result of InternetGetConnectedState).
This can be confirmed with Graph function (every call made by printf has been ignored):
Thus, it can be said that the purpose of this program is to check the connected state of the system.