Chapter 2 – Static Analysis – Techniques and Tooling

The challenges in Chapter 2 cover the basic static analysis of binaries. The answers are as follows:

Challenge 1

1. The SHA256 sum of the sample is B6D7E579A24EFC09C2DBA13CA906227 90866E017A3311C1809C5041E91B7A930.
2. The ssdeep of the sample is 3072:C5OLkQW8JS0k0wcBalDIs3hlAp5+hQQE89X3Qo+PgaE3:CsWnGYlAp5+hR9sYaE.
3. Utilizing what we've learned from static cryptographic hashes, we can utilize OSINT sources such as VirusTotal to learn that this sample corresponds with the SolarMarker family of malware.

Challenge 2

For this challenge, you could locate the kill-switch domain for WannaCry just by utilizing the strings utility! The domain you should have uncovered was as follows:

ifferfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com