1

While viewing the PE headers and imported functions of some programs designed with visual C. I found that they all include one of these functions:

  • MSVCRT.DLL
  • MSVCR80.DLL
  • MSVCR90.DLL
  • MSVCR100D.DLL
  • MSVCRT20.DLL
  • MSVCRT40.DLL
  • And other DLLs which starts with the MSVC prefix.

Does this mean that any program (even malware) that imports any of these functions must be compiled by MSVC ?

Improve this question

2 Answers 2

Reset to default
2

While it's possible for something to be compiled with a compiler other than MSVC and "manually" import from an MSVC DLL, it's extremely unlikely and uncommon.

Chances are, yes, if you see something importing from an MSVC DLL, it was very likely compiled with MSVC.

Keep in mind though that it's possible to have an executable compiled with MSVC that doesn't import functions from an MSVC DLL.

Improve this answer
-2

"Extremely unlikely and uncommon" sounds exactly like something malware would try/strive for.

Using normal WinAPI functions, as a distraction for the reverser or a time-wasting mechanism against an emulator, in malware packers is common .
There is no reason for not using msvcrt.dll functions (However one cannot count on Redistributable Packs for Visual Studio X being installed so the presence of msvcrt90.dll and similar is a flag against it being malware), so the presence of msvcrt* is not reliable at all.

Entry-point signature, Rich signature or the debug directory would be better choices.

Just quickly: Those with a D are the debug versions.

Improve this answer
4
  • 1
    "'Extremely unlikely and uncommon' sounds exactly like something malware would try/strive for." -- Over the past eleven years of analyzing malware, I've never once seen non-MSVC-built malware import from an MSVC DLL. But even if malware did, so what? There's no real benefit to doing so.
    – Jason Geffner
    Commented Jul 29, 2014 at 17:37
  • "Using normal WinAPI functions in packers is common, actually mandatory ." -- No, it's not mandatory.
    – Jason Geffner
    Commented Jul 29, 2014 at 17:37
  • Only slightly better obfuscation would be to add imports of all major C compilers (Borland, Watcom, gcc). I see no point in doing so. It would be easier still to not use any external DLLs.
    – Jongware
    Commented Jul 29, 2014 at 20:05
  • @JasonGeffner Ok I revise my word choice. It isn't mandatory per se but you need SOMETHING to waste time for the emulators. So either normal WinAPI functions or just plain junkcode like in old-timey polymorph engines (with the pointless math and stack movments). And the latter one has it's problems like: arxiv.org/ftp/arxiv/papers/1104/1104.3228.pdf So, it isn't strictly mandatory but it is the most sensible and IMO only worthwhile approach
    – user45891
    Commented Jul 29, 2014 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.