The hidden meaning of the source code of the malware?

Question

I'm studying the source code of malware developed in c++ and I have two questions in the source code below

This is probably code that loads malicious dlls into memory.

typedef BOOL (WINAPI *VirtualFreeT)(
    __in LPVOID lpAddress, 
    __in SIZE_T dwSize, 
    __in DWORD dwFreeType
    );

char dllA[] = {'K','E','R','N','E','L','3','2','.','d','l','l','\0'};
char dllB[] = {'V','i','r','t','u','a','l','F','r','e','e','\0'};

VirtualFreeT pVirtualFree=(VirtualFreeT)GetProcAddress(LoadLibrary(dllA),dllB);

_asm nop;
_asm nop;
_asm nop;
_asm nop;
_asm nop;
_asm nop;
_asm nop;
...
..
.

Why not declare the name of dll as below?
Is it just a certain insertion of a null char?

char dllA[] = "KERNEL32.dll";
char dllB[] = "VirtualFree";

It doesn't do anything. Why need this code?

_asm nop

Is this the original source code, or is this decompiled from a binary? — Sjoerd, Dec 30 '20 at 10:30
maybe there is no reason, in which case, this may not be worth studying, except to see what kind of cargo cult script kiddies are currently using — user253751, Dec 30 '20 at 16:22

gowenfawr · Accepted Answer · 2020-12-30T17:00:18.447

Why not declare the name of dll as below? Is it just a certain insertion of a null char?

No, these two lines of code create identical null-terminated strings in the resultant binary:

char dllA[] = {'K','E','R','N','E','L','3','2','.','d','l','l','\0'};

and

char dllA[] = "KERNEL32.dll";

Perhaps the malware author believed there was a difference, but more likely, it's a style choice only.

It doesn't do anything. Why need this code?

It's almost certainly a NOP Sled. When placing a buffer overflow, it may be difficult to calculate exactly where the instruction pointer will land. By preceding the meat of the overflow code with a series of No-Op instructions (which do nothing) that instruction pointer can slide smoothly along until it reaches the exploit code, as long as it lands anywhere in the NOP Sled.

The hidden meaning of the source code of the malware?

1 Answers1