Chapter 1 of PMA Learning

Practical malware Analysis

For the first chapter, we mainly use some static toolsProgramAnalysis.

Gains: Three new important software:

Pebrowsepro: view the PE File Header, but I prefer stud_pe.
Depends.exe: Import and Export tables and linked libraries clearly show that the general functions of malicious programs can be preliminarily guessed through these methods.
Resource hacker: I think the biggest feature I have found is to export resource files directly, which is useful for storing executable files in resources.

An online detection Website:

Https://www.virustotal.com/zh-cn/

Some exercises after class:

ESP law, dump, repair import and export table with UPX shell, and take off.
With FSG 1.0-> dulek/XT, it takes some effort to find OEP.
My method: There is a nested loop in it, various hops, directly find a point, next breakpoint, unlimited F9, record F9 times. When running the flight, start again. The next time the number of times is reduced by 1, and then F8 is used for tracking.
However, the repaired program cannot run.
If the resource file contains an EXE file, use resource hacker to export the binary file to an EXE file. OD reads the file and it should be a Downloader.