Challenge

Utilizing the unknown.exe sample from the malware sample pack, and without running the application, attempt to answer the following questions utilizing any of the tools we've covered in this chapter – or any tools you're familiar with that provide the same information:

1. Is the sample packed? What packer does it use?
2. What kind of PE is this?
3. If the sample is packed, unpack it. What's the raw size of the .text section after it's been unpacked?
4. What DLLs does the sample import? Are there any suspicious functions called from these DLLs?
5. If there are suspicious functions, name one, and what arguments it accepts from the function that calls them.
6. Give a brief overview of the capabilities of this malware as you understand it.