Analyzing a possibly malware sample

Question

I am trying to analyze a possible malicious sample. It's a windows executable

e3f04124e2e26f8f030f6845086875a9
Md5sum
Intel 386 or later processors and compatible processors

File 2464.exe
2464.exe: PE32 executable (console) Intel 80386, for MS Windows

https://tinyurl.com/4k962erx
It showed some data like
1. unusual section name ".leopard" 2. Raw size of ".bss" is zero 3. Found VM detection artifact "RDTSCP trick"

I am how having a unusual section name .leopard is a trouble and how .bss of size zero is a sign of
malicious activity. Also what is RDTSCP trick and are there any other ways I could analyze the
sample

Answer 1

• The weird sections are a sign that this sample is probably packed, especially the '.leopard' section. You can try to search if this section name is related to a known packer, and try to unpack it dynamically. Otherwise, you can use an unpacking service like 'Unpack.me', drop your sample in it, and wait for the payload.

Keep it mind that only judging a file through it's sections is not really effective. It's not because you have a weird section's name/size that this is 100% malicious. Try to have a global picture of what this binary does, when and where, and you would be able to say if this is malicious or not.

• The 'RDTSCP trick', as you call it, is in fact a CPU instruction. Once again, it is not an indicator that this is a malware (not this instruction alone). But the idea is that this instruction returns the current 'timestamp' of the CPU. If a malware monitor it's time of execution before and after doing something important, it may be able to detect if someone placed breakpoints during this routine. Since the delta between a set of several CPU instructions is very low, a malware can detect that someone paused the execution if this delta increased (subtraction of the timestamp after the execution and the one before).