Functions labeled sub_XXXXXXXX (XXXXXXXX = function address) are functions that IDA does not have a symbol table or F.L.I.R.T signature for. If we take a look at the Functions box, we see a list of function names and if you scroll a bit to the right you will see some info about each function such as the segment location and start address. I won’t do a tutorial on IDA but I will give some quick explanations on features that are relevant to our analysis.

Once IDA has finished its analysis of the PE, we are presented with the default view which has several tabs such as the IDA View, Hex View, Structures, Enums, Imports, Functions, and Exports. rsrc section so we might want to verify in IDA as well and see if it is referenced at all. If you recall in Part I, we discovered a DLL in the. To ensure that the section is loaded, we need to check the Load resources button at the bottom right of the window. When we load the binary in IDA, we get a pop-up window with several options to check before the analysis starts. The minimum functionality needed to accomplish our analysis is the standard x86 disassembler which comes with all versions. For this article, I will be using the pro version so there may be some additional labeling seen in the screenshots to come that will not appear in the free version.

IDA is known for its Fast Library Identification and Recognition Technology also known as F.L.I.R.T which identifies standard function calls for multiple compilers. IDA or the Interactive Disassembler is a tool created by Hex-Rays that “ …is capable of creating maps of their execution to show the binary instructions that are executed by the processor in a symbolic representation (assembly language).” In other words, IDA can take a compiled binary (EXE, ELF, Mach-O, etc.) and break it down into assembly level instructions which makes it easier for reverse engineers to analyze. In this article, we will continue our analysis using IDA Pro to see if we can validate those findings as well as uncover additional functionality of the binary.

In Part I we conducted static analysis using basic tools and techniques on a malicious Windows portable executable and came up with several findings.

Windows 10 won t go into sleep mode