{"id":15584,"date":"2018-06-12T10:00:39","date_gmt":"2018-06-12T09:00:39","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=15584"},"modified":"2021-06-02T17:26:42","modified_gmt":"2021-06-02T16:26:42","slug":"malwarebytes-challenge-write-up","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2018\/06\/malwarebytes-challenge-write-up\/","title":{"rendered":"Malwarebytes challenge write-up"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n
<\/div>\n
Malwarebytes published on April 27th a new reverse engineering challenge, an executable mixing malware behavior with a traditional crackme look. It came in the form of a Windows executable<\/span><\/div>\n

This document describes the solving step of the challenge.<\/p>\n

Lightweight analysis of \u201cmb_crackme_2.exe\u201d<\/span><\/h2>\n
\n

As we would do with any real malware, we start by performing some basic information gathering on the provided executable. Even if the static and dynamic approaches gave us similar conclusions on the executable\u2019s nature (see 2.4), the different methods have been described nonetheless in the following sections.<\/p>\n

Basic static information gathering<\/h3>\n

Using Exeinfo PE<\/b>, a maintained successor of the renowned (but outdated) PEiD<\/b> software, gives us some basic information about the binary:<\/p>\n