I am trying to analyze a possible malicious sample. It's a windows executable

Intel 386 or later processors and compatible processors

File 2464.exe
2464.exe: PE32 executable (console) Intel 80386, for MS Windows

It showed some data like
1. unusual section name ".leopard" 2. Raw size of ".bss" is zero 3. Found VM detection artifact "RDTSCP trick"

I am how having a unusual section name .leopard is a trouble and how .bss of size zero is a sign of
malicious activity. Also what is RDTSCP trick and are there any other ways I could analyze the

  • Take a look at the TRANScurity platform where you can inspect the contents with own scripts
    – PAX
    Commented Apr 23, 2021 at 6:32
  • A virustotal search reveals some suspicious warnings... tread with caution. You can see more info in the "Behavior" section.
    – Xiddoc
    Commented Sep 21, 2021 at 18:23

1 Answer 1

  • The weird sections are a sign that this sample is probably packed, especially the '.leopard' section. You can try to search if this section name is related to a known packer, and try to unpack it dynamically. Otherwise, you can use an unpacking service like 'Unpack.me', drop your sample in it, and wait for the payload.

Keep it mind that only judging a file through it's sections is not really effective. It's not because you have a weird section's name/size that this is 100% malicious. Try to have a global picture of what this binary does, when and where, and you would be able to say if this is malicious or not.

  • The 'RDTSCP trick', as you call it, is in fact a CPU instruction. Once again, it is not an indicator that this is a malware (not this instruction alone). But the idea is that this instruction returns the current 'timestamp' of the CPU. If a malware monitor it's time of execution before and after doing something important, it may be able to detect if someone placed breakpoints during this routine. Since the delta between a set of several CPU instructions is very low, a malware can detect that someone paused the execution if this delta increased (subtraction of the timestamp after the execution and the one before).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.