In this lesson, we will discuss about the different phases of static malware analysis, as we already know,
static analysis is a technique of analyzing a sample file without executing it.
This method involves extraction of useful information from the suspected binary, which can help us
make informed decisions on how to classify the malware, how to analyze it and where to focus our subsequent
analysis efforts.
As a first step, we do a antivirus scan.
If the antivirus detect the sample as malware, then we don't need to do any further analysis as all
the information about the malware will be available in the vendor portal.
However, it is worth noting that this scan has to be performed with all the features in the antivirus
enabled, something called as deep scan.
If the antivirus doesn't detect the sample as a malware, as a second step, we will see if any other
vendor will detect this as a malware.
That is, we might be using Symantec in our company and the company might not have the signature to
detect it, this specific malware.
So we will see if any other vendor like McAfee or Trend Micro or Kaspersky can detect this sample as
malware.
Now, does this mean that we need to purchase all these antiviruses?
No.
There is a Web based tool called As Virustotal this tool is run and managed by Google and is free to be
used by anyone.
It can be accessed at
www.virustotal.com
How do use this tool, should we submit the file sample directly to virustotal?
There is a risk in doing so.
Remember, the file is a suspicious file, but it is not yet proven to be a malware.
What if this file is a clean file and holds on some sensitive information about your company?
If you upload it to virustotal, everyone in virustotal community can see the file.
So it is never a good idea to submit the file itself.
Then how do we do it?
We submit the file hash.
Every file has a unique fingerprint called file hash.
So how do we get the file hash, we have a tool called as hashcalc short for hash calculater to calculate
the hash values using different algorithms in this image, we have submitted a file sample called
track 01 dot mp3 and.
Hashcalc has calculated various hashes for us like MD5, SHA one, etc..
It is important to follow the best practices to evaluate if using virustotal is the right for the
scenario, one has to realize that the details of all the submitted files are stored and accessible
to all virustotal community users.
So never submit the actual file.
Instead, use the file hash.
There is a risk involved in submitting the hash too , which is the attacker, might also subscribe
to virustotal community and keeps checking if anyone submits the hash of the malware he has written in a
targeted, advanced, persistent threat.
This might force him to trigger other methods or use other attack vectors.
Next step is we need to understand the actual file type attackers use different techniques to hide
their file by modifying the extension, changing the icon, etc. This is done in order to trick the
users, to execute it so it becomes necessary to determine the actual file type of the suspected malware.
Knowing the file type will help in identifying the malware target operating system, that is whether
it is targeting Windows or Linux or Mac operating systems and also the architectures like 32 bit or
64 bit OS.
File types can be identified by the magic number.
Remember the DOS header in the PE file format?
Magic number is a number embedded at the beginning of a file that indicates its file format.
It is also referred to as file signature.
Though magic numbers are not visible to users there are specialized tools called as hex editors to see the
magic number one such tool is HxD.
As shown in the image, when a file is loaded onto HxD the very first few bytes indicates the file type,
in this case it is.
FF D8 FF E0, which denote a JPEG file the list of all file signatures are recorded in
the Wikipedia.
A link to the same is provided in the resource section of this lesson.
There is an alternate tool to detect the file type of a sample called Exeinfo PE.
This is a graphical tool that tells if a file is executable or not.
Next, we need to check for Packers'.
To refresh the concept, packers are used to compressed binary files.
Malware authors use the Packers to obfuscate their malware.
Example of packers, include UPX, Exe Stealth and PESpin
When binary is packed, the number of readable strings in the sample are reduced, thereby making the
process of malware analysis complex so it is essential to unpack a sample before analysing it.
Exeinfo PE, which was used to learn about the file format, will also help in checking if a file
is packed.
It also gives unpacking instructions.
In the image we have loaded, Exeinfo PE dot exe and the tool says it is packed with UPX.
Down below, it also gives us hints on unpacking the file.
In this case, we can use the tool upx dot exe with the argument of dash d.
Next important step in static malware analysis is string analysis, it is a process of extracting readable characters
and words from the malware.
Strings will help us in understanding the functionality of a malware.
It does so by giving us information like the list of libraries and functions used in the malware.
Any message that the program is trying to print on the screen, like error messages, pop ups, etc..
File names and file path it is creating or accessing or modifying.
URL's and IP's present typically malwares connected to a domain on an IP address, which is called as
Command and Control, through which the malware author controls the malware.
And string analysis also gives us a registry keys, the keys being created, deleted or modified.
Care has to be exercised while doing string analysis because attacker might include fake string to
misguide the analysis.
There are two widely used tools for string analysis.
One is a Sysinternal tool from Microsoft called strings.
It is a command line tool, the other one is bin text.
It works exactly like strings, but has a graphical user interface, next phase of analysis is to look
into the details of PE file.
We have already learned a few things about PE file structure.
Let's use the knowledge in understanding the malicious indicators in the PE file.
First, we will look at a time date stamp.
This is a date and time when the file was built or compiled.
This is usually set during the compilation process, but it can easily be modified by some specialized
tools.
If the value is older than 1992 or said to a future date like 2022, it
would possibly be a malware file.
Next, we will look into the number of sections field.
Most non-malicious PE file use small number of section. usually between one to six, if there are more
number of sections like more than 10, it could possibly be a malware.
We should also focus on the characteristics or permissions of the sections, usually the dot text section
that contains the executable code should never have write permissions.
However, malware authors keep changing the dot text section in order to morph the malware in order to avoid
detection.
Write permission on a dot text section is an indicator of a malicious file.
Next, important section we look into is the resources section denoted by dot rsrc
As discussed in earlier modules, this section holds the supporting images, fonts, icons, strings,
etc..
A malware could use the resource section to store configuration data and code that assists in malicious
functionality.
Another aspect of resources is the language attribute, which will help us in understanding if the malware
is targeting a specific country based on language like Russian, Chinese, Arabic, etc. in some rare
cases, it could help to attribute the source of malware.
That is, identifying who is behind the malware.
But malware authors deliberately include a different language to misguide the analysis.
Next, we will look at the size of the resource section.
Usually the size of the resource section will be less compared to the overall file size.
Like less than 25 percent compared to the overall file size.
That is if the full file size is 1 mb, the resources could be around 250 to 300 kb, anything
more than 30 percent could mean it is malicious.
This is because malware authors have a practice of using resources section as a storage place for additional
execution code, in some cases, an entirely new PE 32 file is stored within a resources section, only to
be dropped onto a system post infection.
We should also consider the entropy of the whole file and entropy of each section, entropy is the measurement
of randomness.
More randomness means higher entropy value.
If the entropy is high, then it could mean that the binary is encrypted.
Which is an obfuscation technique used by malware authors.
The tool that will help us to dissect and understand the PE file structure is PE studio.
In fact, this one tool can help us understand various aspects of the file sample, including strings,
libraries and functions, magic number, etc..
In the next lesson, we will take a look at demonstrations of all the tools discussed here.