API Call Analysis

Question 1

Which are the best API indicators for extracting the file and writing it on disk for execution?

Answer 1

FindResource, LoadResource, SizeOfResource and LockResource API calls near WriteFIle and CreateProcess calls.

Question 2

Name some best PE Examiner tools?

Answer 2

CFF Explorer, Detect It Easy (DIE), PE viewer, 010 Editor, Hex Editor.

Question 3

Name calling conventions of functions ?

Answer 3

cdecl, standard call, Fast call, This Call

Question 4

Which API call is made to create mutex? or which API is imported to create mutex?

Answer 4

CreateMutexA

Question 5

Why malwares created mutex?

Answer 5

To avoid reinfecting the same machine.

Question 6

What is the basic functionality of mutex?

Answer 6

Main functionality of mutex is to specialize resources, mutex ensure that single resource is not accessible by multiple parties. Malware authors use mutex to determine if target machine already infected or not.

Question 7

Is Mutex name an IOC ?

Answer 7

Yes.

Question 8

Name typical API imports for keyloggers?

Answer 8

GetKeyState, GetAsyncKeyState, GetWindowText, OpenClipboard, GetClipBoardData,CloseClipboard