I am trying to solve a CTF challenge with levels with escalating difficulty.
At this point, the program (PE32 executable) is detected as malware (wacatac to be more precise) by Windows Defender. It could be a false positive, but I didn't run it yet.
So far I've tried to open it with IDA, Radare2, and Ghidra, but all of them have problems when trying to parse the file:
- IDA - "the processor type 'cli' is not included...",
- Radare - "[w] Cannot open 'dbg://../a.exe' for writing.", and
- Ghidra can't properly decompile it.
I will look into those to see if I am missing something, and also tomorrow I'll try to run it inside a VM. Am I doing something wrong? Are there any other approaches that I'm missing or some way to analyze malware?
