First, let's look at some recommendations that are mainly applicable to static analysis:
- When working with the memory dump rather than the original sample, it may happen that the import table has already been populated with APIs' addresses. The easy way to get the actual API names in this case is to use the pe_dlls.idc script, which is distributed in the pe_scripts.zip package. This is available for free on the official IDA website. From there, you need to load the required DLLs from the machine where the dump was made. Don't forget to remove the filename extension for the DLL when loading it, since a dot symbol can't be used in names in IDA.
- It generally makes sense to recreate structures that are used by malware in IDA's Structures tab rather than adding comments throughout the disassembly, next to the instructions that are accessing their fields by offsets. Keeping track of structures is a much less error-prone approach, and means that we can...
