pestudio the file opts for cookies on the stack

dwShareMode of zero instructs the OS to prevent other processes from accessing the file.The 3rd parameter is the dwShareMode, which is set to 0 (zero).The file name stored in previous call is passed first.The CreateFileHandleA call pictured takes 7 parameters, but the most critical are the first and 3rd DWORD PTR SS: is a pointer where the file name will be stored.0 (zero) indicates we want the name to the current file.

The GetModuleFileNameA call pictured first takes two parameters (Remember, function arguments are pushed in reverse order): The following location ( EBP+406BF1) refers to GetModuleFileNameA.You'll find that this location contains a pointer to CreateFileA.Jump to Expression ( Ctrl-G) EBP+406BED.It also displays call function identifiers when the integer value is a pointer to a function.This view will display 4-byte integer values (Little Endian) and the ASCII representation.Choose Long -> Address with ASCII dump from the right-click menu.Memory DumpThe dump pane (below the assembler window) allows can help us inspect the pointers being accessed through EBP. SHA256: 94f690dec48f9080eb0ba00e823e26a59c1b7dabe695ed954f9715afc313a730Īccording to Malwr's sandbox report, here are the high-entropy signs that indicate that this binary contains encrypted and/or compressed data: Target machine: Intel 386 or later processors and compatible processors Static Analysis Tools: pestudio, Immunity Debugger, CFF Explorer, PEID, BinTextĭynamic Analysis Tools: pexplorer, ProcMon, RegShot, ProcDump, Autoruns, Wireshark, Sandboxieįile Type: PE32 executable (console) Intel 80386, for MS Windows

Pestudio the file opts for cookies on the stack