Lab 20-2

The purpose of this second lab is to demonstrate virtual functions. Analyze the malware in Lab20-02.exe.

NOTE This program is not dangerous to your computer, but it will try to upload possibly sensitive files from your machine.

Questions 1) What can you learn from the interesting strings in this program?

This program has some interesting strings. Two of these strings hint at a possible FTP client functionality to either download or upload files.

• ftp.practicalmalwareanalysis.com
• “Home ftp client”

With the Exercise “Note” above, it is obvious that the Malware will likely upload files via FTP. Also there are other interesting strings such as “.pdf”, or “.doc”, which indicate that the Malware may look specifically for document files - let’s imagine some sort of espionage information stealer.

2) What do the imports tell you about this program?

There are several Imports, which indicate different types of possibilities, but specifically some Imports corroborate with the answer 1), such as FtpPutFileA, and FtpSetCurrentDirectory. FindFirstFileA, and FindNextFileA, also imply that the Malware will iterate over files, maybe looking for specific files (as mentioned at 1) ).

3) What is the purpose of the object created at 0x4011D9? Does it have any virtual functions?

At 0x4011D9 we see the usage of the new operator, which indicates that the constructor of an object class being called.

Depending on the file extension, the Object is instantiated, but different methods will be called afterwards:

^

There are two functions, found in a vtable for this class:

Both functions are rather similar. These functions upload a file via FTP, and the only difference is the folder to which the files are uploaded. sub_401380 uploads files to a directory named “pdfs”, and sub_401440 will upload files to a directory named “docs”. Here’s an example for sub_401380:

For all other file types, there is a third function (sub_401370), which does nothing. Therefore, only .doc, and .pdf files are uploaded.

Specifically, at 0x4011D9 the object being instantiated is some sort of a “file object”, and in this case it is a .doc file.

4) Which functions could possibly be called by the call [edx] instruction at 0x401349?

As mentioned in 3), there is a vtable at 0x4060D8. This vtable has two functions, sub_401440, and sub_401440.

These functions upload a file via FTP, and to two different folders. The first function will upload .pdf files to a folder called “pdfs”, whilst the second one will upload .doc files to a folder called “docs”.

5) How could you easily set up the server that this malware expects in order to fully analyze the malware without connecting it to the Internet?

There are many tools, and approaches that can be used in order to setup the FTP server. The first step is to resolve the ftp.practicalmalwareanalysis.com domain to a controlled server, which is running an ftp server. In this case I used vsftpd, and inetsim dns server. Inetsim also has an ftp server, but it wasn’t working as well as I expected, thus I used vsftpd.

After installing the FTP server, the “docs” and “pdfs” folders, as seen in 3), were created.

The Malware uses an anonymous user login, and here’s an example of the files uploaded to the FTP server:

Looking at the file names, a pattern is clear. All files begin with the hostname, and then they a counter, followed by the extension. For each file that has either a doc or pdf extension, the counter is incremented, and used in the filename.

6) What is the purpose of this program?

The purpose of the program is clear. The objective is to steal document files from the victim machines (.doc, and .pdf). All files are uploaded to the malicious ftp server, and have the hostname from which they were stolen from in the filename.

7) What is the purpose of implementing a virtual function call in this program?

The purpose of implementing a virtual function is to allow it to be overridden by a subclass. In this case, there’s a “FindFileData” class, that is overridden when a doc or pdf file is found. Depending on the type of file