Q:

1. What anti-disassembly technique is used in this binary?

Q:

2. What rogue opcode is the disassembly tricked into disassembling?

Q:

3. How many times is this technique used?

Q:

4. What command-line argument will cause the program to print “Good Job!”?

Q:

1. What URL is initially requested by the program?

Q:

2. How is the User-Agent generated?

Q:

3. What does the program look for in the page it initially requests?

Q:

4. What does the program do with the information it extracts from the page?

Q:

1. How is the malicious code initially called?

Q:

2. What does the malicious code do?

Q:

3. What URL does the malware use?

Q:

4. What filename does the malware use?