PEiD: Nothing Found (but shows Win32 GUI as its subsystem). “” seems not a helpful signature, since it is a valid domain. The file “CryptoLogFile.txt” may be used to detect this malware, since it is created at first to log all the files encrypted. A DNS query is also triggered for domain “”. 2 new entries are added into the registry, and one of them is the malware itself. Most imports are ReadFile/CreateFile/DeleteFile. The encryption routine is also a DIY method without calling existing crypto libraries. The IP/domain of the networking is encoded instead of plain text. Before you start, make sure you have a Windows VM (KVM/VirtualBox/VMware) ready with networking disconnected from the host machine.

This post is about the first malware/ransomeware uploaded. All malware binaries are compressed by 7Zip with password “malware” protection. Download the malware – play with your own risk!Īll the malware samples can be found on my github ( ).

If you are interested in MRE or wants a job for that, do buy this book ( ) and give it a complete read. Instead, this was my first trial and I intended to put as much information as possible. Note that this report has no way to be a good one. What seems ridiculous to me is how trivial one can write into any process on Windows XP, which was apparently designed for malware! Regardless of all those Windows craps, this post is to share a general working flow of malware reverse engineering on Windows (XP) platform, and the corresponding tools. I took a “Malware Reverse Engineering (MRE)” class last semeter and it was fun to me, partially because I was not a Windows person, though I am still not.

Procmon malware analysis