Malware Analysis Basics

Content Discussion
1

Not exactly sure how to answer question 2 of the Guided Exercise for the “Malware Analysis Basics” course. I tried the Hex values at the location, I tried converting values separated by null bytes into decimal values, etc. Any idea what is expected or how to arrive at the correct answer?

What is the first 8-digit value that appears in the assembly code for the killRDP function when examined in Ghidra’s Code Browser?

2

The question is asking for the memory address of the start of the killrbp function decompiled in Ghidra.

image
image982×663 151 KB