Now we are analyzing spark that Excel is opened the code browser here and going to do the entry point
so you can look for the entry function in symbols tree here program tree and symbol tree.
So we will open the symbol tree here and we have the entry functions here and we will double click on
that.
And here we are seeing this.
So we will also want the the compiler here.
So that's it.
So we have two functions here.
So the compilation of this functions looks readable.
The security in it cookie is a memory corruption protection function introduced by the compiler.
So go ahead with the main startup by the double clicking on it.
So there are a lot of functions recognized by Ghidra here.
So let's focus on the only the function that not recognized yet, which is this here.
Think 1045556.
So here, this is the main function of the program.
So if you have some cplusplus background, you will also notice that the this win cmd line here, this
should be somewhere here in cmd ln.
Initialize some global variables here.
So as you can see, it's initialized with var four and we will double click on it here.
And here, as you can see here, it initialized some global variables like here.
So.
At the.
And it also initialize the environment and heap for the process.
So and then the main function is called.
So the thing with our function that ends with thunk function that with F 60, it should be somewhere
here.
So here, as you can see, we can see in the ln and so ln is the winmain function.
So we will rename this.
Song for function.
Function 00455F 60.
Function to winmain.
So we will just press on the l key.
Uh, while uh, focusing or clicked on the phone.
Or you can also right click on it and click on rename function.
So we will rename it to win Main Win main here.
And that's it.
So Ghidra allows you to rename variables and functions, introduce commands, and modify the disassembly
and the compiled code in a lot of aspects.
So this is essential when reverse engineering a malware.
So we will double click on winmain.
So we will also we can also return retype, return, edit, function signature and so on, so undefined
winmain and so on.
And we took two steps here so we can also have the undefined for here, as you can see here, integer
E var one.
Undefined.
Eight.
Pascal and Main.
And we are returning here.
Here.
So we took these steps to identify where the malware starts to analyze its flow from the beginning.
So but there are some functions in the Decompiled code listing that we don't know about or anything
we don't know about.
Right?
So our job here is to reveal their functionality in order to understand that malware.
So keep in mind that malware analysis is time consuming task.
So don't waste your time with the details, but also don't forget anything important.
So next we will analyze each of the functions listed in Win Main here this winmain the compiled code,
and we will start analyzing the first function, which is located on line 20, and we will start analyzing
the first which that ends with 40 here.
Function 004, five three, three and 40.