Practical Malware Analysis - Labs Writeup - Lab 1
In this blog series, I am revisiting the industry classic, ‘Practical Malware Analysis.’ While the book is considered a legacy text in the rapidly evolving cybersecurity landscape, its core principles remain an unparalleled starting point for any researcher. My objective is to provide a definitive ‘closure’ to this foundational material through a structured, hands-on deep dive.
My goal is to bridge the gap between these classic fundamentals and the modern era. I will be leveraging modern analytical frameworks to sharpen both my essential and advanced skills. Despite the use of laboratory samples, I will treat every post as a high-stakes investigation. This means delivering professional-level reports that include custom YARA signatures and detailed MITRE ATT&CK matrices, ensuring the output reflects the rigor of current industry best practices.
Although I initiated this project several months ago, I am now returning to it with a significantly higher degree of technical rigor. My time spent engaging with the malware research and threat hunting communities has provided me with a more nuanced understanding of modern workflows, which I am now applying to both new labs and the retroactive update of my earlier entries.
[!NOTE] Post is still work in progress.
Chapter 1
Lab 1-1:
Hashes
DLL:
- MD5:
290934c61de9176ad682ffdd65f0a669 - SHA1:
A4B35DE71CA20FE776DC72D12FB2886736F43C22 - SHA256:
f50e42c8dfaab649bde0398867e930b86c2a599e8db83b8260393082268f2dba
EXE:
- MD5:
bb7425b82141a1c0f7d60e5106676bb1 - SHA1:
9dce39ac1bd36d877fdb0025ee88fdaff0627cdb - SHA256:
58898bd42c5bd3bf9b1389f0eee5b39cd59180e8370eb9ea838a0b327bd6fe47
Question 1: Upload the files to VirusTotal and view the reports. Does either file match any existing antivirus signatures?
Lab01-01.exe
Lab01-01.dll
Question 2: When were these files compiled?
-
Lab01-01.exe: Sun Dec 19 16:16:19 2010 UTC -
Lab01-01.dll: Sun Dec 19 16:16:38 2010 UTC
Question 3: Are there any indications that either of these files is packed or obfuscated? If so, what are these indicators?
Lab01-01.exe
Lab01-01.dll
For both samples, the calculated entropy is in the mid-range. PEiD didn’t detect any packer used, but was able to detect the most likely compiler. With BinText, we are able to see readable strings. Therefore, there are no indicators that those binaries were packed.
Question 4: Do any imports hint at what this malware does? If so, which imports are they?
For Lab01-01.exe, there are a couple of imports that attract attention:
KERNEL32.dll
- File Operations: CopyFileA CreateFileA CreateFileMappingA FindClose FindFirstFileA FindNextFileA
- Memory Management: MapViewOfFile UnmapViewOfFile IsBadReadPtr
Potentially the binary creates some files. Potential dropper (?)
For Lab01-01.dll:
KERNEL32.dll
- Process Creation: CreateProcessA
- Timing / Evasion: Sleep
Most likely this DLL spawns a new process, and some of its actions are delayed (maybe to make malware less likely to be noticed by the user? Or to synchronize its activity with some events/resource availability?).
There are also imports from WS2_32.DLL called by ordinal. All of them strongly suggest network activity:
WS2_32.DLL
- Initialization: WSAStartup WSACleanup
- Configuration: socket inet_addr htons
- Connection: connect
- Data Transfer: send recv shutdown closesocket
Question 5: Are there any other files or host-based indicators that you could look for on infected systems?
In the strings of Lab01-01.exe, we can find a reference to the file kerne132.exe (with “one” instead of L) in the location C:\windows\system32\.
For Lab01-01.dll, there are no clear host-based indicators.
Question 6: What network-based indicators could be used to find this malware on infected machines?
Lab01-01.exe doesn’t contain any obvious network-related indicators.
Lab01-01.dll references the IP address 127.26.152.13.
Question 7: What would you guess is the purpose of these files?
It looks like a RAT/backdoor disguised as a system file (kerne132.dll), with persistence implemented.
Lab 1-2:
Hashes
Packed:
- MD5:
8363436878404da0ae3e46991e355b83 - SHA1:
5a016facbcb77e2009a01ea5c67b39af209c3fcb - SHA256:
1c876a332d7dd8da331cb8eee7ab7bf32752834d4b2b54eaa362674a2a48f64a61
Unpacked:
- MD5:
8363436878404da0ae3e46991e355b83 - SHA1:
5a016facbcb77e2009a01ea5c67b39af209c3fcb - SHA256:
1c876a332d7dd8da331cb8eee7ab7bf32752834d4b2b54eaa362674a2a48f64a61
Question 1: Upload the Lab01-02.exe file to VirusTotal. Does it match any existing antivirus definitions?
This sample is old, so nothing surprising there.
Question 2: Are there any indications that this file is packed or obfuscated? If so, what are these indicators? If the file is packed, unpack it if possible.
With PEiD, we can quickly find that it detects the UPX packer, with the entry point pointing to UPX1.
We get the same result with Detect It Easy:
String extraction also confirms that UPX was used:
TODO: Try to perform manual unpacking!
Question 3: Do any imports hint at this program’s functionality? If so, which imports are they and what do they tell you?
Lab01-02.exe -> Packed
KERNEL32.dll
- Memory Management: VirtualProtect VirtualAlloc VirtualFree
- Core / Execution: ExitProcess LoadLibraryA GetProcAddress
ADVAPI32.dll
- Services: CreateServiceA
WININET.dll
- Network: InternetOpenA
Lab01-02.exe -> Unpacked
WININET.dll
- Network / Comm: InternetOpenA InternetOpenUrlA
ADVAPI32.dll
- Services / Persistence: CreateServiceA StartServiceCtrlDispatcherA OpenSCManagerA
KERNEL32.dll
- Timing / Sync: SystemTimeToFileTime CreateWaitableTimerA SetWaitableTimer WaitForSingleObject
- Process / Thread: CreateThread ExitProcess
- Mutex Management: OpenMutexA CreateMutexA
- System Info: GetModuleFileNameA
Functionality breakdown:
InternetOpenA+InternetOpenUrlA: Internet-related functions. Indicates some kind of internet connectivity (Connection to C2 server?) or downloading additional binaries/resources.CreateServiceA+StartServiceCtrlDispatcherA+OpenSCManagerA: Service management functions. Most likely persistence mechanism utilising a Windows Service.CreateMutexA+OpenMutexA+ (CreateThread): Enforces a single instance of the process running on the host, possibly spawning in a new thread.SystemTimeToFileTime+CreateWaitableTimerA+WaitForSingleObject: Time-sensitive functionality. Possibly a scheduled beacon or delayed request to a C2 server.
Question 4: What host- or network-based indicators could be used to identify this malware on infected machines?
- Host-based: A malicious service named
MalService(?). - Network-based: There is a reference to the URL
hxxp[://]www[.]malwareanalysisbook[.]com/that might potentially be used for C2 connection.
Lab 1-3:
Hashes
- MD5:
9c5c27494c28ed0b14853b346b113145 - SHA1:
290ab6f431f46547db2628c494ce615d6061ceb8 - SHA256:
7983a582939924c70e3da2da80fd3352ebc90de7b8c4c427d484ff4f050f0aec
Question 1: Upload the Lab01-03.exe file to VirusTotal. Does it match any existing antivirus definitions?
Question 2: Are there any indications that this file is packed or obfuscated? If so, what are these indicators? If the file is packed, unpack it if possible.
When we check the binary with PEiD, the tool suggests that the file is packed with FSG 1.0 -> dulek/xt.
String extraction only revealed a small amount of meaningful strings, while the imports table consists only of LoadLibraryA and GetProcAddress from KERNEL32.dll (those two are required to call unpacking logic).
Additionally, entropy is very high, equal to 7.351.
Question 3: Do any imports hint at this program’s functionality? If so, which imports are they and what do they tell you?
We cannot say anything definitively without unpacking the sample first.
Question 4: What host- or network-based indicators could be used to identify this malware on infected machines?
Nothing can be extracted from the packed sample without execution or unpacking.
Lab 1-4:
Hashes
- MD5:
625ac05fd47adc3c63700c3b30de79ab - SHA1:
9369d80106dd245938996e245340a3c6f17587fe - SHA256:
0fa1498340fca6c562cfa389ad3e93395f44c72fd128d7ba08579a69aaf3b126
Question 1: Upload the Lab01-04.exe file to VirusTotal. Does it match any existing antivirus definitions?
Question 2: Are there any indications that this file is packed or obfuscated? If so, what are these indicators? If the file is packed, unpack it if possible.
Based on results from PEiD, the binary is not packed, with an entropy equal to 5.28:
Strings are also human-readable in abundance, which strongly suggests that the sample is not obfuscated:
Question 3: When was this program compiled?
