Static Malware Analysis
LetsDefend
In which packer/protector is the executable packed?
A) eXPressor
What is the version of the packer used on this executable file?
A) 1.6
What is the specific section name used by the packer on this executable?
A) .ex_cod
Which packer was used to pack the executable?
A) upx
How many sections are there in the executable file?
A) 3
How many sections does the unpacked version of the executable file contain?
A) 5
What is the MD5 hash of the unpacked version of the executable file?
A) d5a318eac96aa442ec0b241c1e7acaeb
What is the extension of the file contained within the given zip file, based on its format?
A) PDF
How many of the files contained within the given zip file are Windows executable files?
A) 4
What is the hex value of the magic number in the file header of Windows executable files with the “.exe” extension?
A) 4D5A
What is the extension of the given file?
A) exe
What is the SHA1 file hash of the given file?
A) ef3d2563fa3e29c1be76a149ff91398ab9987775
Is the given file malware?
A) Y
What is the “First Submission” date of the given file in VirusTotal?
A) 2016-12-06 09:28:55 UTC
What is the IP address that the given executable file communicates with?
A) 192.168.68.147
In which .NET version is the given executable created? Find it with Strings analysis.
A) 4.0
Which function from the “User32.dll” file is imported into the given executable file?
A) CharUpperBuffW
From which DLL file were all the functions imported, excluding the functions imported from the “User32.dll” file, into the given executable file?
A) KERNEL32.dll
Which function imported into the given executable file is responsible for terminating the process?
A) ExitProcess
Does the given executable file have a revoked certificate?
A) Y
What is the name of the vendor that signs the given executable file?
A) U.K. STEEL EXPORTS LIMITED
How many icons are present in the executable file as resources?
A) 1
What file extension do the icons in the resources of the given executable file have?
A) png