I am trying to solve a CTF challenge with levels with escalating difficulty.

At this point, the program (PE32 executable) is detected as malware (wacatac to be more precise) by Windows Defender. It could be a false positive, but I didn't run it yet.

So far I've tried to open it with IDA, Radare2, and Ghidra, but all of them have problems when trying to parse the file:

  • IDA - "the processor type 'cli' is not included...",
  • Radare - "[w] Cannot open 'dbg://../a.exe' for writing.", and
  • Ghidra can't properly decompile it.

I will look into those to see if I am missing something, and also tomorrow I'll try to run it inside a VM. Am I doing something wrong? Are there any other approaches that I'm missing or some way to analyze malware?

  • Can you share the SHA256 of the file that you're working on?
    – Utkonos
    Apr 24, 2022 at 5:05


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.