in (provided here as findAntiVM.py). What does it find?

Q:

3. What happens when each anti-VM technique succeeds?

Q:

4. Which of these anti-VM techniques work against your virtual machine?

Q:

5. Why does each anti-VM technique work or fail?

Q:

6. How could you disable these anti-VM techniques and get the malware to run?

1. What are the exports for this DLL?

2. What happens after the attempted installation using rundll32.exe?

3. Which files are created and what do they contain?

4. What method of anti-VM is in use?

5. How could you force the malware to install during runtime?

6. How could you permanently disable the anti-VM technique?

7. How does each installation export function work?

1. What happens when you run this malware in a virtual machine?

2. How could you get this malware to run and drop its keylogger?

3. Which anti-VM techniques does this malware use?

4. What system changes could you make to permanently avoid the anti-VM techniques used by this malware?

5. How could you patch the binary in OllyDbg to force the anti-VM techniques to permanently fail?