| | | | | | | | |
| | | | | | | | |
DataRescue Research Update (25/05/2003)
These analysis come from a real trojan we've received by e-mail.
Easy cases are, well, easy...
 |
 |
Harder cases still not perfect, but getting there
:00403690 .text:00403690 .text:00403690 sub_403690 proc near ; CODE XREF: sub_40372F+31p .text:00403690 ; sub_40372F+41p .text:00403690 .text:00403690 arg_0 = dword ptr 10h .text:00403690 .text:00403690 push ebx .text:00403691 push esi .text:00403692 push edi .text:00403693 xor edi, edi .text:00403695 push edi ; reinit .text:00403696 call get_random .text:0040369B pop ecx .text:0040369C xor edx, edx .text:0040369E push 1Ah .text:004036A0 mov ebx, [esp+4+arg_0] .text:004036A4 pop ecx .text:004036A5 div ecx .text:004036A7 mov esi, edx .text:004036A9 add esi, 61h .text:004036AC cmp ebx, 4 .text:004036AF jz short loc_403729 .text:004036B1 cmp ebx, 1 .text:004036B4 jnz short loc_4036CB .text:004036B6 push edi ; reinit .text:004036B7 call get_random .text:004036BC pop ecx .text:004036BD xor edx, edx .text:004036BF push 0Ah .text:004036C1 pop ecx .text:004036C2 div ecx .text:004036C4 mov eax, edx .text:004036C6 add eax, 30h .text:004036C9 jmp short loc_40372B .text:004036CB ; --------------------------------------------------------------------------- .text:004036CB .text:004036CB loc_4036CB: ; CODE XREF: sub_403690+24j .text:004036CB test bl, 2 .text:004036CE jz short loc_4036E3 .text:004036D0 push edi ; reinit .text:004036D1 call get_random .text:004036D6 pop ecx .text:004036D7 xor edx, edx .text:004036D9 push 1Ah .text:004036DB pop ecx .text:004036DC div ecx .text:004036DE mov esi, edx .text:004036E0 add esi, 41h .text:004036E3 .text:004036E3 loc_4036E3: ; CODE XREF: sub_403690+3Ej .text:004036E3 push edi ; reinit .text:004036E4 call get_random .text:004036E9 test al, 1 .text:004036EB pop ecx .text:004036EC jz short loc_403706 .text:004036EE test bl, 4 .text:004036F1 jz short loc_403706 .text:004036F3 push edi ; reinit .text:004036F4 call get_random .text:004036F9 pop ecx .text:004036FA xor edx, edx .text:004036FC push 1Ah .text:004036FE pop ecx .text:004036FF div ecx .text:00403701 mov esi, edx .text:00403703 add esi, 61h .text:00403706 .text:00403706 loc_403706: ; CODE XREF: sub_403690+5Cj .text:00403706 ; sub_403690+61j .text:00403706 push edi ; reinit .text:00403707 call get_random .text:0040370C test al, 1 .text:0040370E pop ecx .text:0040370F jz short loc_403729 .text:00403711 test bl, 1 .text:00403714 jz short loc_403729 .text:00403716 push edi ; reinit .text:00403717 call get_random .text:0040371C pop ecx .text:0040371D xor edx, edx .text:0040371F push 0Ah .text:00403721 pop ecx .text:00403722 div ecx .text:00403724 mov esi, edx .text:00403726 add esi, 30h .text:00403729 .text:00403729 loc_403729: ; CODE XREF: sub_403690+1Fj .text:00403729 ; sub_403690+7Fj ... .text:00403729 mov eax, esi .text:0040372B .text:0040372B loc_40372B: ; CODE XREF: sub_403690+39j .text:0040372B pop edi .text:0040372C pop esi .text:0040372D pop ebx .text:0040372E retn .text:0040372E sub_403690 endp .text:0040372E |
 |
That's all, folks... stay tuned for more.