"Skype" Trojan Analysis

Last week, we received a sample that was spammed to a Skype user through a message containing a link. The user clicked on the URL and downloaded a file named sp.exe that was executed. This trojan, is not to be confused with the Chatosky malware which also propagates through skype chat messages.

This week i will present the analysis of sp.exe because it is an interesting case study. This trojan uses interesting techniques such as encrypted data, obfuscated function loading, delta based data addressing (for injected code), its own IAT-like array that get injected into the remote processes, the offsets made up to call various subfunctions (no direct cross references), the download of payloads from a remote website for execution on the heap, and etc.

The file was protected with "NTkrnl Secure Suite", a commercial protection system using anti-cracking techniques, polymorphic engines, and other interesting features.