Malware Analysis: Quiz 2 Submitted by: Jack McCarthy TD Waterhouse jackmccarthy -AT- ( tdwaterhouse & com ) October 14, 2005 Creating a Sel F e Xtracting (SFX) Archive File Using WinRAR This will show how the self-extracting file malware-quiz.exe was most likely created by Pedro when using the program WinRAR. Let’s begin the archiving process for this file. Or as I like to phrase it, “Let’s roll this ‘evil’ file up into a self-extracting, innocent looking file with a pretty little MSN butterfly icon on top.” Step 1 Start up the WinRAR application; click ‘Browse for folder’ under the ‘File’ menu and browse to the location of the file. 1 Step2 With the file highlighted, clicking on the ‘Add’ button will kickoff the archiving process. Touchpad Driver For Acer Aspire E 15. In Fig.2 we are given the opportunity to give our new archive-to-be a name and selecting the ‘Create SFX archive’ option will give the file its self-extracting feature. 2 Step 3 In Fig.3, under the ‘Advanced’ tab and clicking on the ‘SFX options’ button will lead us to Fig.

4, where we can now configure our ‘Advanced SFX options’. Fig.3 Step 4 This is where all of our self-extracting configurations will be set. The default ‘Path to extract’ is configured under the ‘General’ tab. 4 Step 5 The ‘Modes’ tab will give us our ability to drop into ‘silent’ mode, making sure nothing is displayed on the screen when the file is executed.

5 Step 6 The ‘Text and icon’ tab is where you set the title of the SFX window (that we’re suppressing from being displayed, ‘silent mode’), the text to be displayed in the SFX window (again, not seen due to ‘silent mode’) and towards the bottom is where you can pick the deceiving icon that you would like to be associated to this file. 6 Step 7 The ‘License’ tab is where you can set the title of the licensing window and any licensing text that you want to have displayed. Again, this window will not be displayed due to the ‘silent mode’ that we will be running under.