Malware Analysis: Quiz 2

Submitted by:

Jack McCarthy

TD Waterhouse

jackmccarthy -AT- (\tdwaterhouse & com\)

October 14, 2005

Creating my own version of malware.exe

This is how I created my own version of malware.exe using the Open Watcom compiler.

Step 1

You will first need to download the Open Watcom compiler and install it. [See the tools section for more information on the Open Watcom compiler.]

Step 2

Once you have the Open Watcom compiler installed, you will need to compile your source code. The following is the source code I created using notepad and named it malware.c:

#include <stdio.h>

int main( void )

{

int i=0;

while (i < 99)

{

printf( "This is a test of the malware broadcasting system, this is only a test - FF.FF.FF.FF\n" );

i++;

}

return 0;

}

Running the following command will compile the source code into an object file, malware.obj.

Running the following command will now link it, creating our final product, malware.exe.

Running the file we just created, malware.exe, will produce the following output:

Running Strings against our file produces the following output.

Notice the similarities between the Strings output of my file and the Strings output of Pedro's file.