Category: Puzzle #5

Puzzle #5 Winners

By Lenny Zeltser. Lenny teaches the reverse-engineering malware (REM) course at SANS Institute.

We are very grateful to everyone who submitted answers to our Puzzle #5: Ms. Moneymany’s Mysterious Malware. Congratulations to everyone who provided correct answers to this network forensics puzzle with a malware twist.

Don Jackson submitted the solution that we picked as the winner of this contest. We were very impressed with the thoroughness of his description, with the attention to detail, and with the focus on network-related aspects of the incident. Reading Don’s solution made us feel like we are looking over the shoulder of the forensic analyst, as he formed theories and looked for evidence to substantiate or disprove them. Great job, Don, and congratulations on winning the Lenovo Ideapad netbook!

We also wanted to mention several other solutions that ranked close to the top:

We were impressed by the in-depth dive yulyul2003 took when looking at the inner-workings of the malicious executable. Though this level of detail was a bit outside the scope of this puzzle, we liked the analysis yulyul2003 performed of the infection and rootkit-related functionality of the specimen. This solution also provides excellent details regarding the infection mechanism.

Eugenio Delfa created a handy tool called castflow for carving PCAP files, which he used to extract files from the network traffic capture. Eugenio also performed some behavioral analysis of the malicious executable in the lab–we appreciated seeing these details in his write-up.

Iñaki Rodríguez showcased the use of tshark for analyzing network traffic–very nice. We also liked the use of Snort by dn1nj4 to examine the network traffic capture for signs of malicious activity.

Thanks to everyone who participated in this puzzle!


Don Jackson (wins a Lenovo Netbook)


Bashar Ewaida
Christian North
Eric Kollmann
Eugenio Delfa
Iñaki Rodríguez
Mark Hillick
Scott Cubic


Ahmed Adel Mohamed
Alan Tu
Ashish, Garima, Vikrant
Candice Quates
Chet Kress
Dave Eilert
Don Jackson (winning submission)
Jeff Wichman
Joe Creasey
Masashi Fujiwara
Matt Erasmus
Param Singh
Peter Chong
Scott Cubic
Shane Kennedy
Takuro Uetori
Tareq Saade
Victor Ant Torre
Winter Faulk

Puzzle #5 Closed

Hi folks,

Puzzle #5 is now closed! Thank you all for your entries. The answers and winners will be up soon. Stay tuned for Puzzle #6, which comes out next week… 🙂

Puzzle #5: Ms. Moneymany’s Mysterious Malware

Our latest forensics puzzle has a malware twist to it, and was written by Lenny Zeltser. Lenny teaches the reverse-engineering malware (REM) course at SANS Institute.

The puzzle:

It was a morning ritual. Ms. Moneymany sipped her coffee as she quickly went through the email that arrived during the night. One of the messages caught her eye, because it was clearly spam that somehow got past the email filter. The message extolled the virtues of buying medicine on the web and contained a link to the on-line pharmacy. “Do people really fall for this stuff?” Ms. Moneymany thought. She was curious to know how the website would convince its visitors to make the purchase, so she clicked on the link.

The website was slow to load, and seemed to be broken. There was no content on the page. Disappointed, Ms. Moneymany closed the browser’s window and continued with her day.

She didn’t realize that her Windows XP computer just got infected.

You are the forensic investigator. You possess the network capture (PCAP) file that recorded Ms. Moneymany’s interactions with the website. Your mission is to understand what probably happened to Ms. Moneymany’s system after she clicked the link. Your analysis will start with the PCAP file and will reveal a malicious executable.

Here is the network capture file for this puzzle. The MD5 hash of this PCAP file is c09a3019ada7ab17a44537b069480312. Please use the Official Submission Form to submit your answers.

Answer the following questions:

1. As part of the infection process, Ms. Moneymany’s browser downloaded two Java applets. What were the names of the two .jar files that implemented these applets?
2. What was Ms. Moneymany’s username on the infected Windows system?
3. What was the starting URL of this incident? In other words, on which URL did Ms. Moneymany probably click?
4. As part of the infection, a malicious Windows executable file was downloaded onto Ms. Moneymany’s system. What was the file’s MD5 hash? Hint: It ends on “91ed”.
5. What is the name of the packer used to protect the malicious Windows executable? Hint: This is one of the most popular freely-available packers seen in “mainstream” malware.
6. What is the MD5 hash of the unpacked version of the malicious Windows executable file?
7. The malicious executable attempts to connect to an Internet host using an IP address which is hard-coded into it (there was no DNS lookup). What is the IP address of that Internet host?

Prize: Lenovo Ideapad S10-2 netbook

Deadline is 5/13/10 (11:59:59PM UTC-11) (In other words, if it’s still 5/13/10 anywhere in the world, you can submit your entry.)

Consider using an automated tool for extracting file artifacts (web pages, executable files, etc) embedded in the network capture file. Doing this manually tends to be slow and error-prone.

Also, note that to complete a comprehensive analysis of this incident, we should examine the malicious executable that found its way onto Ms. Moneymany’s system. That task is outside the scope of this particular puzzle, but we may look at it in a later puzzle.


When answering this puzzle, remember that you will be working with real-world malicious software. Be careful not to infect yourself! Use an isolated system, which you will be able to reinstall at the end of your investigation.

About Your Solution:

Use the Official Submission form to submit your solution. All responses should be submitted as plain text. Microsoft Word documents, PDFs, etc will not be reviewed.

When grading your solutions, we will not just look for correct answers, but will also look at the explanation of how you derived your answers. The winning solution will stand out due to its elegance, insights, and readability. In the event of a tie, the entry submitted first will receive the prize.

You are welcome to collaborate with other people and discuss ideas back and forth. You can even submit as a team (there will be only one prize). However, please do not publish the answers before the deadline, or you (and your team) will be automatically disqualified.

By submitting your answer to this puzzle, you agree to license your solution’s text according to the Creative Commons v3 “Attribution” License.

Coding is always encouraged. We love to see well-written, easy-to-use tools which automate even small sections of the analysis process. Graphical and command-line tools are all eligible. You are welcome to build upon the work of others, as long as their work has been released under a license that allows free derivative works.

Exceptional solutions may be incorporated into the SANS Network Forensics Investigative Toolkit (SNIFT kit) and/or Reverse-Engineering Malware course materials. Authors agree that their code submissions will be freely published under the GPL license, in order to further the state of network forensics knowledge. Exceptional submissions may also be used as examples and tools in the Reverse-Engineering Malware or Network Forensics course. All authors will receive full credit for their work.

Getting started with malware analysis:

If you’re interested in malware analysis, here are a few resources to help you get started:

• Building a Malware Analysis Toolkit Using Free Tools
• Using VMware for Malware Analysis
• Introduction to Malware Analysis Webcast

Final Note

Lenny Zeltser holds the copyright for this puzzle. He thanks Anand Sastry, Sherri Davidoff and Slava Frid for their feedback when creating this puzzle.