So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze? And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog.
I started analyzing the file in my VM (Win XP SP 3) and loaded up the malware in Olly. What I noticed is that the code looks encrypted - I searched for all the calls in the code and got this:
Which doesn't seem quite normal.
So I went ahead and started stepping from the EP hopefully landing on some decryption procedure -
I'll briefly explain what I concluded from debugging this code:
1 - Gets the arguments passed to this executable - I'm pretty sure any code before this is irrelevant, but I might be wrong.
2 - Calls GetStartupInfo - not quite sure why
3 - Call 00401C80 passing the EP as a parameter
So I went ahead jumping to
00401C80 to check what this is all about and found this code which kinda looks like junk code to me -
I suspect because there are some instructions that just don't seem logic to me like:
MOV EAX, 64
But I might be wrong.
The problem is that after at the end of the function a value is copied into
ECX and then
CALL ECX is called which eventually ends in memory access violation:
No matter what I do or how I play with the flags inside this function I get an access violation or the code exits.
SOOOOOOOOO, my first thought was that I'm dealing with some kinda anti-debugging technique, so I tried to run the malware inside the VM and intercept some data from it -
And it seems like it's running alright and even created a UDP socket, no access violation or something like that.
I tried looking online for reports about this virus but I couldn't found any resources about how to bypass this obstacle.
Anyone got an idea how I should approach this? why is Olly failing? How does this code knows that it's being debugged? It doesn't seem like it uses some kind of API for that (like IsDebuggerPresent).
Thanks for everyone in advance.