Hello and welcome back.
In this lesson, I'm going to introduce you to the malware analysis process.
The malware analysis process consists of three stages obtaining the malware and then the static analysis
and dynamic analysis and finally doing the reporting.
In a center module, you will find the two stages.
The static analysis and the dynamic analysis, the static analysis is where you are analyzing Milray
with the execution.
Whereas in economic analysis, you are analyzing the behavior midway through execution.
The static analysis techniques include embedded stress analysis and encrypted data analysis in the embedded
stress analysis.
The objective is to extract and examine groups of credible characters from the document in the encrypted
data analysis.
We are interested in searching the document for encrypted or encoded streams of data.
One of the important thing is pattern and signature analysis.
This analysis consists of finding the common patterns in embedded in inside.
The document is so many of the modalities used the same techniques repeatedly in various attacks and
therefore we can identify these common and repeatable patterns in your documents.
So identifying the patterns in your technique is one of the common techniques that is no one else's.
Once we have identified the patterns, we collect signatures to detect those attacks.
This brings us to Yaara here is used to resonators to detect patterns and also to identify malware attacks.
It is a robust language and use a lot among malware analysts.
The repository of can be found in this building here.
This contains only rules that have been written by another analysts, which we can use for identifying
malware documents or other binaries.
You can find out more about it from this link.
This is the Yarra command line YAARA texta arguments and some options.
Ruffa is the name of the cruise that you are going to use in order to scan the file.
They'll be followed by the file that you want to scan, some of the options that are available in the
command line, DFW, which is to turn on warning that you print tags and the print metadata and that
has to print matching strings.
We'll be doing some practical way.
Will take a look at all these options as well as how to usera.
Document files in Microsoft usually have to deal with the tension.
So this means that the file is compressed.
It's a kind of archive.
There are many files, Whodini content types, ASML worth talking, Maximino the Cox e-mail and the
binary file web projecting.
So when you are trying to scan Microsoft geocaches document, you should be aware that you are scanning
the archive rather than the contents.
So that will give you a false result.
So the intention here is to scan the binaries inside here, the VBA project being redundant to scan
the archive itself.
So there is something going on.
So in order to overcome this difficulty, there is to dump the bottom is able to, I think, all the
files within the archive.
And it's also able to run YAARA signatures against each file within the archive.
And this project is can be found at this website here.
So if you are going to use Yaara to scan, you can use it in conjunction with it, no.
So let's say we have a document, DCX, which is an archive containing all these files, Whodini.
This is one way in which you can you sit down this time?
Xianjun Guess why for your signature file, followed by the signature here file.
This is your signature file and followed by the Target Microsoft document which you want to scan.
And the analysis is metadata analysis.
Metadata is information and what the document contained within the document you can find things like
date and time stamps in the metadata, the language that is being used by the computer that was used
to create the document and even the name of the author, the author of information, and as well as
many other documents, specific information.
So.
Exhibit two is a common tool used to extract metadata from files, and it is found in this website.
These are some of the output you can find from the EXIF to.
We can show you the time the occupation title and hot information file type, the file modification,
the creation and so on.
So this is some of the things we doing here and doing analysis of malware documents.
So that's all for this review.
Thank you for watching.