CMSC449_A-6

.docx

School

University of Maryland, Baltimore County *

*We aren’t endorsed by this school

Course

449

Subject

Computer Science

Date

Jan 9, 2024

Type

docx

Pages

8

Uploaded by ChefOryxMaster925

CMSC 491/691 Malware Analysis HW 6 Name: Ricky Kapoor Assigned: 11/15/2023 Due: 11/29/2022 by 5:30pm Download the OllyDumpEx plugin and ImportREC.7z onto your VM. Place OllyDumpEx_Imm18.dll inside of the C:\Progam Files (x86)\Immunity Inc\Immunity Debugger\ folder. Unzip ImportREC.7z. The password is “imprec”. OllyDumpEx_Imm18.dll: https://drive.google.com/file/d/1xCtIC-9qbWZlqg2ct04-xAqeNPuNCMGK/view?usp=share_link ImportRec.7z: https://drive.google.com/file/d/13rZDfCnv9m9pdrfxDIlVJXvWDmt3NQ1h/view?usp=share_link Download hw6.7z onto your Flare VM and extract it. The password is “infected”. Set your VM’s network adapter to “not attached”. Take a snapshot of your VM when your VM is set up because you will likely need to revert multiple times. You are not required to run Immunity Debugger as administrator. HW 6.7z: https://drive.google.com/file/d/1MOaC0pgfI05o0iG2igpCJf3n4qZcBK6m/view?usp=share_link Hint: Chapter 18 of PMA is a great reference for this homework! Part 1: Unpacking hw6_1.exe (33 pts) Answer the following questions about hw6_1.exe. 1) What is the relative virtual address (RVA) of the entrypoint? (3 pts) 1d001 2) What section contains the unpacking stub? Justify your answer. (4 pts) The section “.aspack” or “Section 8” has the unpacking stub. When navigating to the entry point in IDA, this section contains the command “start”.
3) What section contains the packed data? Justify your answer. (4 pts) The section “CODE” or “Section 1” has the packed data. Its entropy is very high and it contains the largest amount of data. 4) Using one of the methods described in class, find the original entry point (OEP) of hw6_1.exe. What is the address of the OEP? In a few sentences, describe which method you used and how you found the OEP. (8 pts) Address of OEP: 413C14 Description: I used the second method (“Read Breakpoints on the Stack”). First, I found where the executable was pushed onto the stack, then took the bytes in the ESP’s address register when it was run, and set a hardware access breakpoint. Then, I stepped through the remaining instructions until the executable was loaded into the EIP register and “returned” that address. 5) Provide a screenshot of Immunity Debugger showing execution paused at the OEP. Make sure that your screenshot shows the entire window of your virtual machine. (8 pts)
6) Use OllyDumpEx to dump the unpacked hw6_1.exe and then fix its IAT using ImpRec. Provide a screenshot of ImpRec once you have fixed the IAT. Make sure that your screenshot shows the entire window of your virtual machine, and that the ImpRec log shows how many modules and import functions were detected. (6 pts)
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
  • Access to all documents
  • Unlimited textbook solutions
  • 24/7 expert homework help