Hi everyone in this video we will look at some of the Static analysis tools primarily for PE files. 1
So what I mean by static analysis is that you're not going to run or execute that file. 2
They are only going to use this standalone on disk version of the file and then run it through a 3
bunch of static analysis tools to understand its behavior. 4
So if you remember in our previous videos we used tools like hex editors and file format parsers to 5
understand the structure of the file. In this video, 6
We specifically want to focus on some additional tools which can help us understand whether the file 7
that we are looking at is actually a malware file or not. 8
So these are pretty popular Static analysis tools and they are freely available for us to load and use. 9
These are the list of tools that I want you to quickly go through let us come to our virtual machine. 10
So all the all the tools which I'm going to discuss is a part of the FLARE VM utility as well. 11
So if you have installed FLARE then you will have these tools already present on your machine. 12
If you haven't you can individually search for them and download them and that should also be sufficient 13
for you to work with too. 14
So the first tool that I want to talk about is hash calc. 15
It's pretty simple and standard tool for calculating hash of a file. 16
So if you drop any file inside it it will help you calculate Md5, Sha1, Sha2 and whatever hash value 17
you want. 18
So this is a very useful tool for calculating files hash and you can use it as you know an IOC or you 19
can use it for searching on Virus Total and other such services. Second tool that we want to talk about 20
is EXEinfo. 21
This is a very interesting tool 22
so what EXEinfo tells us is, it gives us certain information about the file like the entry point, the 23
EP sections, the files offset, file size, Overlay sections information. 24
And the most important part is it also helps us understand if the file is packed or not. 25
So here I'm using two different malware files for this video section. 26
I'll be uploading both these files and I'll provide the link in the description of this video 27
so you can go ahead and download it from there so that you can replicate the same analysis. So the two 28
files that I'm using is: first one is Maze ransomware. Maze is ransomware family that has been 29
out there for for a while. 30
This is one file and the other one is another backdoor which is packed by unknown packer called UPX. 31
So in EXEinfo let us first drop our Maze ransomware binary. 32
So here you'll see that it will tell us the entry point if you remember and entry point is something 33
which we saw in our previous video that's the location from where the main PE loader of the operating 34
system will begin executing the file. You have the PE section,. 35
The initial few bytes of the file offset, Linker information, file size and overlay formation. 36
Now if you see here it tells us that it's an exe file and it has a standard compiler section. 37
Nothing out of ordinary. 38
So that's it. 39
It did not really pick up anything really different or it did not really pick up any packer information 40
in the file. 41
Now let us try our UPX packed file. If we drop it over here you'll see that it tells me that the EP section 42
consist of a UPX. header. 43
It's file size is this. 44
That's the overlay information and then it tells me that it has been packed by this particular version 45
of the UPX packer. 46
So if you don't know about you UPX, it's a pretty well-known packer for packing the portable executable 47
files. 48
So what happens by packing is that you actually change the overall structure of the file and you replace 49
it with your own structure. 50
The file still works as a standard executable for example if your program is designed to launch calculator 51
if you pack it with UPX, it's still going to launch calculator. 52
The only difference is that UPXpacked file and not have those standard sections which we saw 53
in our previous three videos. 54
They will basically be replaced by UPX's own packer. 55
So when you run it the file unpacked and that's when the proper section gets created. 56
So that's the whole advantage of packers. 57
So packers help you hide all these information like the header information, which import tables have 58
been used and things like that. 59
So those are that's why malware authors rely on packers in order to hide some of these behaviors from 60
these Static analysis tools. 61
So it also tells me that the Packer can be unpacked by downloading the unpacking from the official website 62
site and you can just run the unpack command and it will give you the unpacked or the actual binary. 63
The actual malware payload that you can analyse. 64
So this is the importance of EXEinfo. it just helps us analyze that. 65
ok 66
There is no packer inside the file. The next one is PEID. 67
That's another interesting to 68
launch PEID, drop our packed File. 69
See if you see here again very similar to our previous tool 70
It tells me the Packers information. 71
So this is another common tool which malware researchers or security analysts use to identify if the 72
file contains any Packer or not. 73
So what happens is these tools rely on the standards set off list of known packers. 74
If the malware is packed by a custom algorithm then these tools would not be able to identify those 75
packers. 76
If it is packed by a known commercial packer which we have seen being utilized by malware in the past. 77
In that case these tools will be able to identify the packer information. PE bear is the next tool 78
that we want to look at. 79
Let's run it and drop our maze ransomware file which here see if you see here it's pretty much containing 80
the same information which we have went through in our previous three videos. 81
It tells us a general information about the file like it's hash size the DOS header the rich header 82
information file header optional headers section headers and the import table. 83
So let's try our other file that that would give us some interesting results here. 84
So let's let's look at our UPX packed file. 85
So if you look at the Dos header and if you start scrolling down that's where you'll see the UPX 86
header inside it. 87
So this is how these tools identify that the file is actually packed by a packer. 88
So instead of having the standard sections, it has UPX sections inside the files. 89
This means that the file is actually packed. 90
So it also has the dis-assembled information. 91
This is something that we'll be looking at later on. This will be utilized when we would be reversing 92
the file files using dis-assemblers. 93
So, PE bear was another tool that is pretty interesting for us to know about.