Chapter 5 – Advanced Static Analysis – Out of the White Noise

In Chapter 5, we discussed the more advanced points of static analysis utilizing the NSA's Ghidra and other tools to ascertain information about an executable without running it. The answers to the questions posed are as follows:

1. The sample is packed with the UPX packer.
2. The PE is a Windows .exe file.
3. The raw size of the text section is 00010000.
4. There are several modules and functions imported that you could have chosen – however, one may have caught your eye as it did mine: SetWindowsHookExA.
5. The arguments passed are as follows:

   EDI (0) for dwThreadId

   The current handle for the binary

   0xd – which corresponds to WH_KEYBOARD_LL for the idHook argument

6. You'd be more hard-pressed to find out what this executable can't do. However, based solely on static analysis, we can assume that it can read and write registry keys; read, write, and delete files; download...