To answer the first question, we upload the file to VirusTotal.com, which performs a scan against antivirus signatures.

Next, we open the files in PEview. For each file, we navigate to the IMAGE_NT_HEADERS ▸ IMAGE_FILE_HEADER ▸ Time Date Stamp field, which tells us the compile time. Both files were compiled on December 19, 2010, within 1 minute of each other. This confirms our suspicions that these files are part of the same package. In fact, a compile time that close strongly suggests that these files were created at the same time by the same author. We know that the files are related because of the compile times and where they were found. It’s likely that the .exe will use or install the .dll, because DLLs cannot run on their own.

Then we check to see if either file is packed. Both files have small but reasonable numbers of imports and well-formed sections with appropriate sizes. PEiD labels this as unpacked code compiled with Microsoft Visual C++, which tells us that these files are not packed. The fact that the files have few imports tells us that they are likely small programs. Notice that the DLL file has no exports, which is abnormal, but not indicative of the file being packed. (You will learn more about this export section when we return to these files in Lab 7-3 Solutions.)

Next, we look at the files’ imports and strings beginning with the .exe. All of the imports from msvcrt.dll are functions that are included in nearly every executable as part of the wrapper code added by the compiler.

When we look at the imports from kernel32.dll, we see functions for opening and manipulating files, as well as the functions FindFirstFile and FindNextFile. These functions tell us that the malware searches through the filesystem, and that it can open and modify files. We can’t be sure what the program is searching for, but the .exe string suggests that it is searching for executables on the victim’s system.

We also see the strings C:\Windows\System32\Kernel32.dll and C:\windows\system32\kerne132.dll. (Notice the change from the letter l to the number 1 in kernel32.dll.) The file kerne132.dll is clearly meant to disguise itself as the Windows kernel32.dll file. The file kerne132.dll can serve as a host-based indicator to locate infections, and it is one that we should analyze for malicious code.

Next, we look at the imports and strings for Lab01-01.dll, which imports functions from WS2_32.dll. Because these functions are imported by ordinal, we don’t know which functions are being imported. We also see two interesting functions imported from kernel32.dll: CreateProcess and Sleep, which are commonly used as backdoors. These functions are particularly interesting to us in combination with the strings exec and sleep. The exec string is probably sent over the network to command the backdoor to run a program with CreateProcess. The sleep string is probably used to command the backdoor program to sleep. (This malware is complex. We’ll return to it in Lab 7-3 Solutions, once we have covered the skills to analyze it fully.)