Lab 6-4

In this lab, we’ll analyze the malware found in the file Lab06-04.exe.

Questions and Short Answers

  1. What is the difference between the calls made from the main method in Labs 6-3 and 6-4?

    A: The function at 0x401000 is the check Internet connection method, 0x401040 is the parse HTML method, 0x4012B5 is printf, and 0x401150 is the switch statement.

  2. What new code construct has been added to main?

    A: A for loop has been added to the main method.

  3. What is the difference between this lab’s parse HTML function and those of the previous labs?

    A: The function at 0x401040 now takes a parameter and calls sprintf with the format string Internet Explorer 7.50/pma%d. It builds a User-Agent for use during HTTP communication using the argument passed in.

  4. How long will this program run? (Assume that it is connected to the Internet.)

    A: This program will run for 1440 minutes (24 hours).

  5. Are there any new network-based indicators for this malware?

    A: Yes, a new User-Agent is used. It takes the form Internet Explorer 7.50/
    pma%d, where %d is the number of minutes the program has been running.

  6. What is the purpose of this malware?

    A: First, the program checks for an active Internet connection. If none is found, the program terminates. Otherwise, the program will use a unique User-Agent to attempt to download a web page containing a counter that tracks the number of minutes the program has been running. The web page downloaded contains an embedded HTML comment starting with

你可能感兴趣的:(Lab 6-4)