Malware Handbook
  • Preface
  • Author
  • Prerequisites for Malware
  • Prerequisites for Lab Set-Up
  • Setting Up Labs
  • Download Sample Malware Exercises
  • Intro to Assembly Language
  • Assembly Language Basics
  • Commonly Used Instructions
  • Win32 Assembly Programming
  • PE Format
    • PE32
    • PE32+
  • Malware
    • Types of Malware
    • Malware Classification by Windows Defender
    • Sourcing Malware
  • Malware Development
  • Malware Analysis
    • Malware Analysis Methodologies
      • Static Analysis
        • Static Analysis Tools/Methods
        • Static Analysis of Sample Files
      • Dynamic Analysis
        • Dynamic Analysis Tools/Methods
        • Analyzing Files with Regshot, Process Monitor, and Wireshark
        • Analyzing calc.exe and Network Activity
      • Manual Code Reversing
        • Reverse Engineering Simple Windows Executable Files
        • Reverse Engineering re_lotsastuff.exe
        • Reverse Engineering re_lotsastuff.exe Using Ghidra
      • Analyzing PowerShell Scripts
      • Analyzing JavaScript Samples
        • Analyzing JavaScript in HTML
      • Analyzing Macro Code in Office Documents
      • Setting Up REMnux Environment
        • Setting Up and Configuring FakeNet in REMnux
      • Analyzing an ELF File
      • Analyzing ASPX Webshells
      • Analyzing JAR Files
    • SAMPLE NOTES (of Notes.txt)
Powered by GitBook
On this page
  1. Malware Analysis
  2. Malware Analysis Methodologies
  3. Manual Code Reversing

Reverse Engineering Simple Windows Executable Files

1. Overview of the Session:

  • Objective: Demonstrate how to reverse engineer simple Windows executable files.

  • Files to Analyze: (say)

    • C-Sharp Compiled Program: re_test_Desktopapp1.exe

    • Native Executable File: re_lotsastuff.exe

  • Tools and Setup:

    • Restored Windows VM image.

    • FakeNet tool running to intercept outgoing network traffic.

    • Course files copied into the VM.

2. Analysis of C-Sharp Compiled Program:

  • File Identification:

    • Used Detect It Easy to identify the file type.

    • re_test_Desktopapp1.exe identified as a PE32 file compiled from a .NET source.

  • Decompilation with dnSpy:

    • dnSpy: A .NET decompiler tool used to show the equivalent source in C#.

    • Process:

      1. Drag and drop the sample into the dnSpy console to begin decompilation.

      2. Navigate to the function or method indicated at the entry point.

  • Code Analysis:

    • The code performs the following:

      1. Displays a message box with the text "for educational purposes only".

      2. Attempts to open a webpage from phishing.website.com.

      3. Runs CMD, which opens a command prompt.

  • Using MSDN References: Helpful in understanding the behavior of the code, particularly the functions and methods used.

3. Debugging the Program:

  • Setting Breakpoints:

    • Set a breakpoint at the first line of code where the text variable is set ("for educational purposes only").

    • Use F9 to set the breakpoint.

  • Starting Debugging:

    • Press F5 to start debugging.

    • Use F10 to step over or F11 to step into the code.

  • Observations During Debugging:

    • The program displays the message box as expected.

    • Encountered an issue with the open read function that attempts to read contents from phishing.website.com/dotnet.

    • The function fails, possibly due to coding issues. It's advisable to note this behavior and revisit it later with more information.

    • The final observed behavior is the execution of CMD.

4. Key Takeaways:

  • C-Sharp Language Knowledge: Understanding C# syntax is beneficial when analyzing .NET programs to grasp malware behavior better.

  • Breakpoint Usage: Setting breakpoints at crucial points (e.g., entry points) helps in observing program behavior systematically.

  • Documentation Practice: It's good practice to document all behaviors and potential issues encountered during analysis for further investigation.

5. Transition to Native Executable Analysis:

  • After analyzing the C-Sharp compiled program, the next step is to move on to analyzing the native executable file re_lotsastuff.exe.

PreviousManual Code ReversingNextReverse Engineering re_lotsastuff.exe

Last updated 9 months ago