I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP address. I know it is easier to set-up IP Tables or use Fiddler to redirect the traffic, but I want to learn something new about reverse engineering.
The malware IPv4 address is
184.108.40.206 which I successfully replaced with a shorter address by adding a space (
20 in hex) at the end, and confirmed with netstat. I was expecting to terminate with
0x00 which I found strange.
Since my honeypot IPv4 address is longer, how can I hex edit this into the malware without corrupting the PE? I have had this problem in the past, where I want to increase the length of text within an application, but if I surpass the original text's length is breaks!
If this is not possible with a hex editor (in my case Hex Editor NEO) then I am open minded to other approaches, such as reverse engineering with IDA or OlyDbg, where I can modify the executable file.