-2

I'm testing a malware sample :

hxxps://www.virustotal.com/en/file/55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd/analysis/

This is a malicious executable file. When executed in Windows XP, it exhibits its behavior (ransomware). But the same file when executed in windows 7, it does't show its actual behavior.

Need your help to identify that specific condition in the which makes the malware run only in a specific operating system.

  • 1
    May I suggest that you break that link up into pieces so nobody accidentally clicks on it? – SDsolar Apr 4 '17 at 8:12
  • 1
    That's not a malicious URL. Anyways I have edited it – Lavangam Apr 4 '17 at 8:25
  • 2
    What have you tried doing? where did you get so far? What specific problems you encountered in your reverse engineering process? – NirIzr Apr 4 '17 at 8:45
  • 1
    Did you try to debug the malware on Win7 to see when it fails? – Dillinur Apr 4 '17 at 21:01
2

Need your help to identify that specific condition in the which makes the malware run only in a specific operating system.

Please note malware authors seldomly care about keeping their products updated.

For example, when assembling a ground truth for malware evaluation, there is a clear slope: most samples will work on XP, somewhat less on Windows 7 and even less on Windows 8 / 10 (not much difference here). For each step upwards, you'll lose an average of about 15% of the samples.

Often, you may be able to find a variant of a family capable of running on an newer system (but not for all families).

I figured one of the main reasons is either that the sample checks for a specific windows version or a certain exploit does not work. For example, often privilege escalation using Process Injection may fail on more recent platforms when is was developed for XP. Somewhat more advanced malware even implements different methods for different OS versions.

Please remember that malware deals with pretty low level structures of the system.

TL;DR

Either malware does support multi-os functionality, or it does not.

edit

The .dll you linked seems pretty sraight forward (unpacked?) since it contains some debug information and an intact import table. Is there anything in particular you're having problems with?

Not the answer you're looking for? Browse other questions tagged or ask your own question.