Forum Discussion
Bronze IIPractical Malware Analysis: Static Analysis question 18
You're seeing Microsoft Security Centre in your string. You want a file name that is trying to mimic Security Centre... famously in WannaCry.
Its also right in your C code you posted. Use the first 4 letters of that in strings and I bet you have the file name.
Silver IIIThe question is "What is the exact name of the executable file this malware adopts", and I can't see how this could be related to sprintf. The solution is right under your nose.
Bronze IIfor some reason typing in the variations of "s_%s_%s_security_00431330" does not seem to do anything? sprintf overriding is based on the brief to get the more accurate binary information. but the contents and variables directly from the sprintf seems to be wrong. where should I be going from the analyzing the function call, as the variables found are displayed as incorrect?
