Practical Malware Analysis — Lab 1–2: Basic Static Analysis Writeup

Practical Malware Analysis book cover

In this lab, we will analyze lab 1–2 from Practical Malware Analysis book. The goal is to examine the malware sample Lab01–02.exe using basic static analysis techniques and answer the given questions.

Get Mahmoud Alawady’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

You can download all samples in the book from this GitHub repo.

Safety: These files are malware samples. Only download and analyze them in a properly isolated and controlled environment, such as a dedicated malware-analysis VM. Do not execute them on your host machine or on a system containing sensitive data.

Question 1

Upload the Lab01–02.exe file to http://www.VirusTotal.com/. Does it match
any existing antivirus definitions?

Answer:

After uploading the file, we can see that it matchs existing antivirus signatures. It was flagged by 56 out of 70 security vendors.

Question 2

Are there any indications that this file is packed or obfuscated? If so,
what are these indicators? If the file is packed, unpack it if possible.

Answer:

When we use Detect It Easy, it indicates that the file is packed with UPX 3.04, No other obvious obfuscation indicators were identified.

sample lab1–2.exe loaded in Detect It Easy

We can use UPX to unpack it as follows:

C:\upx\upx.exe -d .\Lab01-02.exe -o lab1-2-unpacked.exe
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2026
UPX 5.2.1       Markus Oberhumer, Laszlo Molnar & John Reiser   Aug 27th 2026

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
     16384 <-      3072   18.75%    win32/pe     lab1-2-unpacked.exe

Unpacked 1 file.

Now, let’s check the unpacked file again using Detect It Easy:

As expected, Detect It Easy no longer detects UPX, indicating that the file was successfully unpacked.

Question 3

Do any imports hint at this program’s functionality? If so, which imports
are they and what do they tell you?

Answer:

Let’s inspect the imports of the unpacked executable, which are more useful for determining its functionality. We can use PEStudio for this:

lab1–2 imports

• InternetOpenUrlA
• InternetOpenA

Indicate that the malware is capable of communicating with remote URLs and may download files.

• OpenMutexA
• CreateMutexA

The malware may use mutexes to prevent multiple instances from running at the same time.

• CreateServiceA
• StartServiceCtrlDispatcherA
• OpenSCManagerA

These may be used for persistence, by running the malware as windows service.

Question 4

What host- or network-based indicators could be used to identify this
malware on infected machines?

Answer:

After unpacking the malware, we can use PEStudio to look for strings:

lab1–2 strings

We can see a URL, http://www.malwareanalysisbook.com, which may be used by InternetOpenUrlA to communicate with a remote server or potentially retrieve files. Therefore, the URL can be used as a network-based indicator.

We can also see MalService, which might be the name of a Windows service used for persistence. Therefore, it can be used as a host-based indicator.

Thank you for reading! This was a basic static analysis of Lab 1–2 from the Practical Malware Analysis book.