Hello and welcome in this introduction, I'm going to introduce you to the objectives of malware analysis
of documents.
With why marriages document, why is there a need to study this now, the authors will try the irritating
thing off in order to get the malware installed in your system.
And out of all the techniques, the easiest way is to use social engineering, social engineering to
you, try to manipulate the user to open a program or a document which will contain.
Nima Elbagir, if the attacker is using documents, then he will send a document to e-mail all to link.
In an email or even put it up on the website and get the user to visit the site to click on the link,
to download and document the document, your site will contain some probably some embedded scripts we
shouldn't execute.
And the script is accurate and do something else.
He will connect to the Internet and download the actual Malvasia.
And this will be the second stage of the on the attack.
The first issue of the.
Tricking the user to open the document itself and once the document is open, the script will activate
and the for the bailouts from the Internet.
That would be the second stage.
The same thing applies to links.
If the attacker managed to get the user to click on links the link, then to download some documents
and then use them openly.
So once the malware is being stopped, the attacker will then have access to whatever was designed in
the proverbial, whether it's ransomware or to steal information, install a back door.
He's a bot or maybe as a proxy for launching further attacks to other nameless.
So in Melbourne, this for documents, what we are looking for here.
Oh, you are asked to download second ballot this year can be embedded in the scripts or hidden in the
document itself.
Oh, and then you also look for commands which the list contained within a script or inside the document.
And these commands could be to use Bauscher to execute some commands or even JavaScript, as in the
case for PDF and the script and so on.
Authorities will be looking for Farnese embedded in the document or in the script.
So sometimes these findings could be obfuscated, even a script to obfuscate it.
So in that case, we need to obfuscate it before we can understand what he's trying to do.
So the findings are important because he will tell you what type of file he's been downloaded and also
where it is going to be safe to.
He may also give you a hint as to what is intended purpose.
And once we get access to it and finally we can start looking for it when it is being done with it.
And then we can do secondary analyses on these files if you so desire.
The next thing we'll be looking for are Embedded Files NHS, which contains the files that the NABAY
downloading a second stage on even embedded files in New Jersey within the document itself, and something
to be able to look for.
The MS imaging bite marks the existence of her B executable file.
So in the next stage, before we do anything, we need to install which machines and which machines
who allow you to conduct your analysis in a safe environment without compromising your host.
And we need to counter with the machine.
One is Microsoft Windows running Windows seven and the other one is running version HA Linux hologram,
which is specially created to analyze and malware.
RAMNATH is necessary and contains all the tools necessary for reverse engineering as well as malware
analysis and for the windows which are machine.
We need it because we need to run the malware in order to do behavior analysis.
So in the next video, we'll go ahead and start with the installation of the voting machines.
So it's all for this lesson.
I'll see you in the next one.
Thank you for watching.