Hello and welcome back.
In this video, we are going to do a practical lapsation static analysis.
We are going to perform static analysis on documents, we are going to do embedded string's analysis,
Xolair analysis.
Yara, metadata.
And the two of us that you need to download malware PDA, visit another office before and the password
to unzip them is cracking lessons dot com.
In addition to these two files, there is also another file, Heroes Rules, which I will provide for
you.
So going down these two files and the JA rule is far from the resource section.
So let's get started.
So put into your Bremner's Linux and then copy the files and download it.
And put them in your Linux shareholder in your Windows and then from your remnants, go through the
files, check for the.
Any Kapela from.
Therefore, the you have put into it in your windows.
So I put it in 01, let my windows, so I'm going to copy these three files, mail office, no PDA here,
the.
How copy and put it inside my home directory, so my home directory is over here home, I will create
a new folder called Milray.
So to create new fodder, you just have to right click here, new for.
So are they ready for the create another site for the 018 and the tree falls to.
So now you're going to extract your arrows, so do a stay of your arrows you can use to unzip.
Come on.
So just open a terminal here, go to activities, click on terminal and then maybe get to your home
directory to see the space and the two.
And you can make your home dietary inside.
You can enter your mail for the listed.
I've already got my arrows, Nancy, but in your case, if you're not asleep, you should enter your
01 folder and then unzip it by typing on the heroes.
So you unzip heroes and you will find a new folder containing all the rules inside the important file.
Is your index yaara false?
So if you scroll through, you can see index TOYIA testing for doing so after you've unzip these terrorist
files, just cut it and pasted in a malware folder above it.
So I've done this, so I'm not going to repeat it again.
So after you've done that, you can start analyzing our first file malware office and never PDF in future.
If you ever want to get the latest heroes rules, you can always navigate to this website, which I
share with you from a previous lesson and then click on code here and click downloads if this is where
you can get your YARE rules.
So the rules is rules continuing on the pattern for malicious code as well as binary, which you can
use to scan files.
It's just like an antivirus repository.
That is not on the mayor's office park and another place.
If so, to do that, let me clear the screen first.
Timeline Zuckermann, followed by the name of the father on transit, and he entered and he asked for
a password type tracking license.
Dot com.
Yes, so after you anticipating there'll be a new photo inside, you will find the Medicare stockier,
an office document.
The second file is now PDF.
So repeat Zuckermann Potiche to file two mail PDF.
And he enter and for a password is also cracking license, dot com,
the password is hidden, so he won't be showing here.
So after unzipping Nupedia, you have another folder containing the mail PDF, malicious --.
So we start by doing a string's analysis of the PDF file.
So in your termini here, you can enter the PDF directory.
Listed and this is the video, you're going to do a stress analysis, just clear a screen first by typing
clear.
So we take the common strings followed by the dashi option means to scan for all strings, followed
by the name of the Profar.
And then he wanted to be able to be scrollable when we view the output.
So we take the Bakerman.
Puckerman is the SIM is a key above the integrity of a keyboard.
You need SIFF Shivji hold on and Presti, but then you get the vertical pache more and be able to less.
So the output of the strings combined will be piped into the second command, which is called less so
that you can screw up and down.
So you press enter and now you see the result.
You can use an Kierkegaard to scroll down or screw up to see the result of your strings analysis.
So as you can see, one of the strings and you found a spider foundation, one that tree, this is a
header to indicate that this is by far the second thing of importance and significance is the JavaScript
file.
So this shows that this -- has embedded JavaScript and is able to run JavaScript commands.
And this is one common tactic used by malicious PDA documents using JavaScript to run something malicious
to create this output.
Just Priscu, the next command we are going to do is to perform a search for encrypted strings to do
that.
And we use our search command.
So are followed by the name of Mi FA VFR and encrypted string that you are searching for.
So in this case, we want to see any encrypted you are out.
So we are searching for his tip and then you can enter and we find that there are no encrypted strings
containing his GTP.
The search for better executables, you can repeat their command exel search, giving it the option
followed by the name of the fire, and we find that there are no embedded executables for this particular
document.
Next year, we're going to do a metadata analysis, so let's clear the screen first for that.
We were used to fall by the name of the file and then we will fight to the last command so that we can
scroll the output.
And this is the result of the metadata skin from the result.
You can see some metadata, the filename PDF and file size, and it found when he was created, it was
created in the 017 December 29.
And his father and sister and maybe type application PDAF less press cue to greet news.
Next, we are going to use a are asking for one this fall.
So to Usera and the expenses will be in the queue to screen first the technical Manyara and then we
provide a provide the path to the Larousse.
So we put a two in front to say home.
Then forward slash go to be malaby for the you created earlier and inside it.
There you are.
Bruce Subfolder and he that the next year far so far will contain a listing of all the rules within
this year.
Bruce Subfolder.
And then follow that with the name of the father and you want to scan and then you can enter and you
find it has a long list of output you can screw up and down using Olby of your mouse or you can use
you.
You can use a scroll wheel to scroll.
Now, in order to suppress the warnings, we can put some additional additional parameters to the rackman.
So let us repeat there you are asking by this time if some options, so the options that we are going
to use.
Yaroun distributed warnings that to bring metadata, that is to bring matching strings and key to prevent
attacks.
So let us clear the screen first and then repeat, command this up here to retrieve the history of this
terminal and then here, move your life all to go to the front.
And that dash w there is a message for the rest of the perimeter and not hit enter.
And now you will see a much easier readable output and you see the three suspicious characteristics
of properties first find suspicious produce, the second one is suspicious creator and third one is
in very trailer structure.
So this tree is enough to raise some flags to warn you about these five.
Below are the rules that was triggered good, you can see what triggered it, for example, here in
this string says Caribous was found to be suspicious because probably in the no way this was also detected.
Same thing with under suspicious.
This was they are the the tax scribbles.
So that's all for this analysis of the PDF file.
In the next video, we will turn our analysis to the manager's office document.
So I'll see you in the next on.