Q:

1. What anti-VM techniques does this malware use?

Q:

2. If you have the commercial version of IDA Pro, run the IDA Python script from Example 17-4 in Chapter 17 (provided here as findAntiVM.py). What does it find?

Q:

3. What happens when each anti-VM technique succeeds?

Q:

4. Which of these anti-VM techniques work against your virtual machine?

Q:

5. Why does each anti-VM technique work or fail?

Q:

6. How could you disable these anti-VM techniques and get the malware to run?

Q:

1. What are the exports for this DLL?

Q:

2. What happens after the attempted installation using rundll32.exe?

Q:

3. Which files are created and what do they contain?

Q:

4. What method of anti-VM is in use?

Q:

5. How could you force the malware to install during runtime?

Q:

6. How could you permanently disable the anti-VM technique?

Q:

7. How does each installation export function work?

Q:

1. What happens when you run this malware in a virtual machine?

Q:

2. How could you get this malware to run and drop its keylogger?

Q:

3. Which anti-VM techniques does this malware use?

Q:

4. What system changes could you make to permanently avoid the anti-VM techniques used by this malware?

Q:

5. How could you patch the binary in OllyDbg to force the anti-VM techniques to permanently fail?