Chapter 7 – Advanced Dynamic Analysis Part 2 – Refusing to Take the Blue Pill

Here, we discussed some more advanced topics revolving around Windows API functionality and manually unpacking malware. In the challenges in this section, you were tasked with answering a series of questions about a likely packed executable:

1. Yes – the sample is packed. Based on your research, you should find that it is packed with a packer called MPress.
2. The SHA256 of the unpacked sample is a23ef053cccf6a35fda9adc5f1702 ba99a7be695107d3ba5d1ea8c9c258299e4.
3. The only imported functions in the packed sample are as follows:

   GetModuleHandleA

   GetProcAddress

   GetDC

   Arc

   PrintDlgW

   FreeSid

   DragFinish

   OleRun

   StrChrIA

   ImageList_Add

   Comparing this list to the list of imports once the sample is unpacked shows quite a difference!

4. The sample has several functions that could ostensibly be used for analysis avoidance, but the easiest to spot is Sleep()! This could be utilized to evade automated...