malwareCoreRuns in the API, always on

Strings Attached

  • easy
  • 100 pts
  • First blood: still open

Printable text inside a file is often the quickest source of leads, and also the noisiest. This specimen carries a few dozen readable strings: most are ordinary padding, and a handful are indicators an analyst would write down. Your task is to find the network host the specimen is set up to contact for its updates.

Open the strings tab and filter. Indicators tend to have a shape you can recognise: a hostname ending in a domain, a path, a user agent, a made-up service name. Padding tends to look like short words, repeated fragments and section labels. Read the whole string around a candidate host before you commit to it: the rest of a URL often says what the host is for.

Everything here is an inert teaching specimen made by us in our own format: it contains no working code, and every host and address in it is fictional. Every domain in the specimen uses the reserved .example suffix and points at nothing real.

Submit the host name the specimen would contact. Afterwards, note which surrounding strings made you trust your pick.

  • malware-analysis
  • strings
  • indicators

Hints

Hints do not affect your points. Each one stays revealed.

Hint 1
Hint 2
Hint 3
Jump to workbench
Loading the play area...