OK. 1
So in this video we're looking at two more interesting tools. 2
One is PPEE and the other one is PE studio. 3
So the new thing which we learned in our previous couple of tools is the way of extracting general information 4
about the file, like its hash value and how to identify whether the file is packed or not. 5
So whenever you're doing static analysis of any PE file, the first thing you want to know is that is it 6
packed or not. If it is not packed, 7
It makes things easy for us. 8
We can start using our standard analysis techniques but if it is packed, we have to make sure that we first 9
unpack the file so that we have the actual file header information. 10
Then only these tools will be able to give us a better information about the file's properties. 11
So let's look at PPEE. Again, if you have FLARE installed, this tool will already be available on your 12
machine. 13
The utilities directory. 14
In fact all the tools that we have looked at in the previous video and this video will be present inside 15
the Utilities folder. 16
So let's execute it. Let's drop our file. Let's try our ransomware file first. 17
Now if you look at PPEE UI, you'll see that this starting information is exactly the same as what we have looked 18
at in some of our other tools and videos. 19
It has information about the headers, file and sections and stuff like that. 20
So this is this is the reason why I first went through helping you understand how to read a file format 21
so that you're not surprised by all these random information that you see when you start using these 22
tools. 23
So if you have a basic idea about file format it will be pretty easy for you to really understand what 24
information these tools are trying to extract. 25
Now the interesting part about PPEE is the string static extracts from the file. So strings is a standard 26
Unix command. 27
You can run it against any file you can just type strings followed by the file and it will tell you 28
all the strings that it could recognize inside the file. 29
So if you see here these are the strings that the tool was able to identify and ASCII format. 30
And there are bunch of strings that the tool could identify in Unicode format. 31
There are two separate sections for them. 32
So here you can see some of the strings are pretty readable like the DLL imports, user32.dll, 33
Kernel32.dll but a lot of them are just random strings. 34
They do not really make any sense just because those characters are readable and exists in a defined 35
order. 36
That's why the tool picked them up. If you come to unicode, 37
You'll see a bunch of Unicode information so you have linker files, temporary files, cryptographic libraries 38
being used. 39
Then you'll see that it's basically trying to run SQL command. select * from Win32 40
Shadow Copy. 41
So if you want to know more about Shadow Copy that would be really interesting and if you have looked 42
at ransomware files before this much information is enough for you to understand that the file that 43
you're looking at is highly likely a ransomware. If it's still not very clear to you will probably 44
be looking at. 45
Another interesting aspect called suspicious. 46
So what PPEE does is that, it runs its own heuristics to extract a bunch of suspicious 47
strings for you. 48
So if you look at the strings over here you'll see that it has extracted content type. 49
This is basically an information that is used when you are trying to connect through an HTTPserver 50
its also looking for and antivirus products. 51
It is also pinging bunch of servers, deleting, ping command, security centers Shadow Copy information 52
and things like that. So let's go back to our unicode strings. 53
So if you keep scrolling down you see information like it's looking for 54
local settings, Internet Explorer information, local data information 55
then as you come down you'll see string called "Encrypting whole system". 56
Then another string called "encrypting specified folder in the path" parameter and then finished. 57
These strings are enough for us to identify that this executable is highly likely ransomware. 58
Now I forgot to give a short explanation of ransomware 59
There is a family of malware which takes hostage of the machine either by completely locking it or 60
by encrypting every file on your machine. 61
It then demands for ransom money in the form of crypto currencies most commonly by using bitcoin. 62
So once you make that payment then only the malware authors would allow you to access your machine or 63
basically decrypt all the encrypted files back into readable format. 64
It's a pretty well known malware family that has been a huge problem for the security industry and over 65
the last five 6 years. 66
So 67
if you come down over here you will see that there is a ransom note so these strings are really common 68
in ransom notes. 69
Will see that it seems that your file has been encrypted by RSA 2048 and Cha-Cha algorithm. 70
The only way to restore them is to buy the decryptor and to buy the descriptor, 71
You have to pay a certain amount of bitcoins or crypto currency is that the ransom authors are demanding 72
from you. 73
They are also kind enough to share a wikipedia link for you to read more about the file. 74
So what that basically means is that they are trying to tell you that no matter what you do you're only 75
going to get your files back unless and until you do not pay for getting the decryption keys so there's 76
a very short introduction. You can read more about ransomware. 77
There is tons and tons of information available. 78
The whole purpose here is to help you understand how and how we can use Static analysis tools to really 79
identify different types of traits and different types of behaviors inside the file. 80
And once you start looking at all these malware more and more that's where you start understanding 81
how exactly to understand the behaviors on the file. 82
In fact if you see here there is a string called Cmaze Ransomware. Maze ransomware family 83
basically so that's why they file which they are currently looking at. That's the ransomware 84
family that this particular file belongs to. 85
So URLL is another specific section that the tool creates. 86
So if by running the String command if the tool is able to extract some URLs they will basically 87
be presented here. 88
Right now it could only extract http:// and % s. It means it's substituting a value 89
that is defined in a different variable. 90
So that's how they are putting up the value over here and calling out to this particular domain. 91
If there was an actual domain over here it's it's possible that it might be the command and control 92
server of that ransomware. Sp that was about PPEE and how we can understand the malware family and 93
behavior by using the static analysis to. The last one that I want to talk about is PE studio that is 94
also one of my favorite tools because it gives us a lot more information about the file so let's again 95
drop our ransomware file over here. 96
This is how it looks like. 97
So if you see the studio is still running a bunch of heuristics on top of default. 98
So the good thing about PPEE and PE studio is that they have their own heuristics. Their own ways of determining 99
whether the file that you're looking at is suspicious or not. So if you see here PE studio has figured 100
out that the file you just scanned has a detection ratio of sixty three on Virus Total. 101
So virus total is a web service where you can scan a file or you can search for a file hash and 102
it will tell you how many of the well known anti viruses 103
have a detection for the file. 104
This is a very good way of identifying whether the file is bad and not. If all the major antivirus vendors 105
are saying that oh this file is known malicious then we know by certain that okay this is a malware file. 106
So if you look at some of the detection names it has ransomware and the ransomware family 107
inside it. 108
So this is also one indication of figuring out that OK the file that we are looking at is nothing but 109
ransomware file. 110
Other than that there is an indicator section. 111
This is something really interesting that PE studio provides us. 112
These are a bunch of indicators that PE studio has extracted for us. So if you see, it has strings 113
which are marked as blacklisted strings. 114
It also references a lot of black listed libraries. 115
So this is the string section and this is the library section so if you go into these sections you can 116
see which ones are blacklisted. 117
The file is also known as bad on virus total it is also importing symbols which have been tagged 118
as bad and the file references MITRE techniques. 119
So these are a bunch of indicators which PE studio used to give us a verdict that defined that we are 120
looking at is actually bad. 121
Let us look at the Libraries section. So if you come here you'll see that these top ones which are marked and 122
set red are the black listed libraries that this particular executable is using. 123
So security service support provider interface, secure32.dll, net API. 124
It's basically a win32 API for using net connections. Crypto API 125
That's the one which gives us the biggest indication about the presence of ransomware on the machine. 126
because this library would help you encrypt the file. In the imports table, to give you a little 127
bit of context about these two you can even follow the link. 128
You could right click on it and you can go to search MSDN. Search MSDN basically opens up your 129
browser. 130
And it goes to Microsoft's 131
MSDN library and it searches for this API to give you more information about why this is used. 132
So there is a very good way of understanding the libraries information. MSDN is your best tool when 133
you want to understand what particular windows library is used for which specific purpose 134
lets come to the strings section. So in the string section, you'll see information like POST, program cannot 135
run in DOS mode, then 136
There are a bunch of GET and POST information 137
so these are these are the strings which we also saw in when we were looking at PPEE. So decrypt-file.txt 138
txt 139
This is basically the ransom note file which gets created on your machine which has all that ransom 140
note information that your file has been encrypted and 141
You have to buy the decryptor tool to take back your files. 142
So this is where PE studio is really really useful in understanding the behavior of files. 143
Let us also try our UPX packed file in PE studio and see what it has preserved. 144
So in the UPX packed as well, you'll see similar sections. 145
virus total tells us all the known antiviruses which have detection for this file 146
still calculating for other indicators and certify you have the file headers. 147
This is something which we have already seen a couple of times in the previous videos sections. 148
It tells me that that's the entry point. 149
It also has figured out that the file has UPX packer inside it. 150
It tells us what percentage of the file is bad. 151
The file percentage ratio, the entry point information and a bunch of other blacklisted details that 152
it could figure out from the file. 153
SoPE studio is also very very handy tool in understanding more traits and behaviors of the file.