So I've been looking at this thread - Where can I, as an individual, get malware samples to analyze?And grabbed myself a binary sample of Win32.Upatre from Halvar Flake's blog.I started analyzing the file in my VM (Win XP SP 3) and loaded up the malware in Olly.What I noticed is that the code looks encrypted - I searched for all the calls in the code and got this: Which doesn't seem quite normal.So I went ahead and started stepping from the EP hopefully landing on some decryption procedure - I'll briefly explain what I concluded from debugging this code:1 - Gets the arguments passed to this executable - I'm pretty sure any code before this is irrelevant, but I might be wrong.2 - Calls GetStartupInfo - not quite sure why3 - Call 00401C80 passing the EP as a parameterSo I went ahead jumping to 00401C80 to check what this is all about and found this code which kinda looks like junk code to me - I suspect because there are some instructions that just don't seem logic to me like:MOV EAX, 64CMP EAX,3E8But I might be wrong.The problem is that after at the end of the function a value is copied into ECX and then CALL ECX is called which eventually ends in memory access violation:No matter what I do or how I play with the flags inside this function I get an access violation or the code exits. SOOOOOOOOO, my first thought was that I'm dealing with some kinda anti-debugging technique, so I tried to run the malware inside the VM and intercept some data from it - And it seems like it's running alright and even created a UDP socket, no access violation or something like that.I tried looking online for reports about this virus but I couldn't found any resources about how to bypass this obstacle.Anyone got an idea how I should approach this? why is Olly failing? How does this code knows that it's being debugged? It doesn't seem like it uses some kind of API for that (like IsDebuggerPresent).Thanks for everyone in advance.
Debugging Win32.Upatre - why does Ollydbg fail to analyze this?
ollydbg;malware;obfuscation;anti debugging;deobfuscation
About the ??3@YAXPAX calls, it is called Name Mangling, take a look at this thread for more explanation.YAXPAX calls are actually the delete C++ operator.About the __set_app_type, __getmainargs, GetStartupInfo etc, those calls are generated by the compiler and usally called before the main function. They aren't part of the source code of the program you are willing to analyze, so you shouldn't have to analyze them.Your main seems to be located at 00401C80, as it is usually right before a call to exit. This is where you start analyzing things seriously.Concerning the anti-debug protection, there are few instructions that let me think there is something that catches the exception in the program :cmp [0], 0 is supposed to crash, so maybe there is some custom exception handlers installed somewhere. I would say to check for TLS callback functions, but I may be wrong. You should be able to pass the exception by pressing Shift+F7, break on NtContinue, read the CONTEXT structure and continue the execution of the program.Here is a listing of the most frequent anti debug tricks you may find - including the Thread Local Storage trick.