[Forensic Analysis] Virut Sample Forensic Features

1. Network Features

ant.trenz.pl 

ilo.brenz.pl

2. File Features

By locating the file, use PEID to view the file segment. If the condition meets the file with the addition of 7 random character segments, it is determined to be an infected file.

3. Infected characteristics

refer to:

【Virus Analysis】Virut.ce-Infectious Virus Analysis Report

http://www.cnblogs.com/17bdw/p/7776877.html

4. Prove that the normal process space contains malicious code

Dump the memory of the infected process, print the strings in the memory through the Microsoft tool String, and search for the IOC domain name string to see the domain name in the network feature. Note: The PID number 604 in the figure corresponds to the infected Winlogon process.

Try to dump all Winlogon DLLs and print them out with Strings in turn. You can locate which DLL has the injected ShellCode