So as the binary references some malicious servers.
As you saw in previous lecture, it must implement some kind of network communication, right?
So in this case.
Here.
This communication is performed via a Http protocol as shown here.
So we will go with a simple tree here.
And after that we will go to imports folder and here we have the URL man and wininet init packages and
we can see this functions.
So looking at this.
Earl.
Montell.
And we also have the ADP here.
So.
This looking at this ad, VP 32.
We can identify functions named rec after rec.
That's something, something here that allows us to work with a Windows registry while others that mention
the word servers and.
SC managers like start service A like set value exam, open servers, Rakoski, Requried and so on.
With this here, this allows malicious attacker to allow to interact with the Windows Service Control
manager, which enables us in to load drivers here.
Right.
And registry.
And we also have.
So there are really a lot of imports in kernel32 DLL also as well as many other things it allows us
to interact with and perform actions related to named pipes, file names and processes.
Let's actually.
Here.
We have a bigger sample tree, right.
We can also drag it down here.
Or if you mess with this view, you can go to window.
Andrew.
Is it your.
You know we've options.
So now we will go to here and.
So as I said, there are really a lot of system 32 kernel 32.
Imports and we also have this Wininet http open request, a http query info a and so on.
So here we identified a lot of things with a very quick analysis.
So if you are experienced you will know malware code patterns leading to a mentally matching API functions
with strings and easily inferring that a malware will try to do when given the previously shown information
here.
So.
In next lecture, we will dissect interesting malware sample parts.
And I'm waiting you in next lecture.