Comments on: Puzzle #5: Ms. Moneymany’s Mysterious Malware

By: Ingeniowerks Security » Ms. Moneymany’s Mysterious Malware

Ingeniowerks Security » Ms. Moneymany’s Mysterious Malware — Sat, 22 Oct 2011 00:14:20 +0000

[...] Analysis Challenge to Strengthen Your Skills. The challenge is actually a modified version of the Ms. Moneymany’s Mysterious Malware puzzle with additional malware analysis questions. So, here we [...]

By: G

Fri, 04 Jun 2010 00:07:10 +0000

Dave,

Now contest is over, I can explain. When you check tcp follow stream option in wireshark, you can see there are few bytes before MZ starts and also at the end there are few extra bytes.
I think foremost check header bytes MZ only to extract exe file.
I think there are 2 ways you can use, manually if you want to carve then you can calculate length of PE file based on PE file structure and second can be run some tool which can create fake client/server request/response that way you can actually download exact pe file.

By: Dave

Dave — Mon, 24 May 2010 00:01:11 +0000

Thanks Ed,

Gave that a shot and still no go. Could be a cross-platform issue, or god knows what. I’m just glad to be on the lookout for it from now on

I’ll dig into it some more when I have time, but thank you all for your suggestions.

Dave

By: Ed

Ed — Thu, 20 May 2010 10:38:30 +0000

Dave,

If you export chunked data from wireshark to unchunk later with another tool, try to export as ASCII and not as raw content.

By: Dave

Dave — Wed, 19 May 2010 17:23:57 +0000

For those that are interested, I was using foremost to extract the exe from a raw chuck exported out of Wireshark. For some reason, this introduced corruption. Using Network Miner, the exe had no issues being unpacked.

This is peculiar to say the least, as the the header and footer of the exe are identical with the corrupted and correct versions. Guess the foremost just fell down in this instance.

By: Dave

Dave — Wed, 19 May 2010 12:16:54 +0000

Winter, G

Thanks for the replies. Now that the contest is over, I can say that I extracted with both foremost and manually. A hexdump shows UPX packing with version 3.0.1. I’ll take a look at the solution once posted and retrace my steps. Thanks again.

By: G

Fri, 14 May 2010 16:47:54 +0000

I have successfully extracted executable from pcap…and there is no checksum error while using appropriate unpacker.

By: Winter

Winter — Fri, 14 May 2010 03:23:37 +0000

@Dave:

I had no problems unpacking it.

I’d look at how you’re extracting it from the pcap file, if you’re positive that you are extracting it correctly then you are probably using the wrong unpacker or a 3rd party unpacker.

By: Dave

Dave — Thu, 13 May 2010 04:38:49 +0000

I can extract the executable from the pcap, but get checksum errors when using the appropriate unpacker. Anyone else having this issue?

By: Lenny Zeltser

Lenny Zeltser — Sun, 04 Apr 2010 01:43:57 +0000

oxff: You’re welcome to use whichever approach you feel most comfortable with. However, I think performing static analysis of the dropped executable is not the easiest way to answer question #7.