Hey everyone welcome to file analysis tools.
In the previous video we covered the extraction and analysis of Internet artifacts.
We're going to take a look at how to analyze files establishing if they're malicious or not.
The type of data they contain the type of data they contain and extracting their bedded metadata in
particular we're going to analyze executive all image and document files using different tools pre-installed
on Kelly Linux static file analysis is an important topic of digital forensics and fundamental in malware
forensics.
We're not going to deal with malware forensics in this video.
But first we want to know when analyzing a suspicious file is if it's malicious or not.
Therefore we could scan it with clam A.V. the Avies scanner installed by default on Kalli Linux.
First we run the fresh clean utility to be sure the Abey signature database is updated.
We execute claim scan on the suspicious file on Kelly Linux.
A graphical front end is also available.
Clam T.K.
in this case claims it has detected a Windows trojan program has detected a Windows trojan program
even if claims can does not detect any threat.
We cannot be definitive if it's not malicious.
So we better submit it so we better submit it to a free online scanning service like Byres total dot
com.
It scans files using many Avies scanners.
It has a file size limit of 128 megabytes but it's enough for most cases file analysis has two phases
content identification and metadata extraction the content identification implies detecting what type
of data the file contains.
On Windows the type of file is usually associated with its extension which is a suffix of the file name
of three letters like Doddie X-C doc X-C doc etc. on Unix derived systems instead.
The file may not have well usually don't have any extensions so we cannot simply rely on the extension
to determine the file type.
Also because anybody could change the extension without affecting its structure and contents.
A much more reliable way to identify a file is by means of the so-called magic number which is a hexadecimal
value embedded in the file header.
Each type of file has a different magic number on Unix derived systems.
Magic numbers are listed in a compiled binary file on Kaua'i Linux.
It's slash user lib file magic MGC to see a list of magic numbers of common file types we can refer
to this page on Wikipedia.
The magic file is used by the Selye utility file to identify the type.
For example we execute file on this malicious file we execute file on the malicious file we scanned
previously despite its extension appearing to be a PDAF document.
In reality the file tool shows it's a Windows portable executive execrable or PGE file
another method to identify a file as another method to identify a file is inspecting it with a hex viewer
or editor or editor like x x D or a g y editor.
We open the same file with x x d.
The first column in the output represents the offsets.
The next eight columns are the hexadecimal representation of the data.
Each column be in two bytes.
The right side shows the A.S.C. I text text representation.
We could see the magic number for this type of e-file is two bytes which is for d 5 A which corresponds
to the string M.Z. in the right.
An unknown file could also be identified on the basis of the National software reference library reference
data set or n s r l Dasch RDX which is a large database of hashes of files.
The database can be freely downloaded at this link but this does not provide a tool to queries.
There's a Seelye client program called s r l look up to query the database.
It's available here.
There's also an n s r l hash search engine and S.R. l hash search engine that supports searches via
M.D 5 as a one or filename submitting one file at a time.
This search engine is available at this link.
Another very useful tool for file analysis.
Are strings which are also installed on on every Unix Linux system.
This tool displays a strength of printable characters that it binds in a given file.
We execute strings on the same malicious file
redirecting the output to a text file
reading this ALPA file.
We could retrieve useful information such as the Win32 API functions called by the programs and eventually
you are else an IP addresses.
We could also perform keyword or regular expression search on the output file using for example the
grep utility.
When analyzing a Windows system given the fact that malware or other files may not have an executive
file extension we might want to find every executive will on the system without manually inspecting
every single file.
To do that a valuable tool comes to our rescue which is mis identify this list executive roles in a
given directory.
By default the program reports only the file names of the executive bills of which the extensions do
not match.
One of the known executive extensions like X-C DL CIS etc..
In this example we assume we mounted under and then malicious suspect directly.
In this example we assume we mounted under and then the malicious suspect directory.
The windows image we've used in the second video of the section the windows image we've used in the
second video of the section about registry analysis we run misidentify on the Windows system 32 folder
specified the r option to also scan its subdirectories recursively
as we could see the files listed do not have a nonexecutive will extension with the option.
All the executive rules are listed regardless of their extensions.
Now we're going to cover the analysis of image and video files.
There are many images and video file formats most popular formats are jpeg PLG BNP G-I death and Tiff.
While the most common video formats are W.M. the MP for move a vi NFL v.
We're going to see how to extract metadata from these types of files metadata as we've already seen
with file systems.
Our data about data in this case metadata is embedded within the file itself.
The most common metadata for image files is e x I-F is exchangeable image file format or S.F. developed
to record metadata about the capturing camera such as the make model and serial number camera settings
date and time and the GPS data for geolocation
XXIV 2 is a tool to extract data from image files.
The use is quite straightforward as we supply the image file with the option to display more verbose
information.
We run X of two on a sample JPEG image file as we could see the output shows quite detailed meta data
information about the image itself the camera and its settings and the GPS coordinates.
Another tool is to be able to extract meta data not only from image but also from video and other common
file formats like exit tool exit tool is not installed by default on Kelly Linux.
So we'll have to install the relative package with the command.
Apt get install.
In this case it says the package is already installed.
We run X of tool on a sample videophile to examine its meta data
the meditate extracted is similar to those of the previous example but specific to the video format
such as the frame rate and the audio properties.
When looking for images on a Windows system it could be useful to analyze thumbnails and associated
meta data window stores the thumbnails of images of a certain directory in the Thums dot db file.
Even when images are deleted the thumbnails and the meta data persist and bums not D-B this kind of
data can be extracted using Veneto for the sake of brevity.
We're not going to run this tool but we will show the options.
We could run it specified the Alper directory where to store the thumbnails with the o option and the
h option to write it H.T. a Mail report to the same output directory.
Kelly Linux also provides tools to analyze documents PTF in particular PDA is together with M-S office
files.
The most popular document file format pedia of metadata can be extracted using EXIF tool.
We execute on a sample pedia file.
This is the output where we run on a sample PTF file with the modification and access dates.
The pedia version the page count and the program used to create it.
There are also tools specifically designed to analyze PDX.
The first tool we cover is PTF ID which scans the PDA for a given list of strings and counts the occurrences.
We execute PTF ID on a suspicious PTF file
it displays the occurrences of sections of javascript code within the document as we can see when executed
on this malicious PTF now malicious PDM is very often contain javascript code which is usually associated
with an automatic action that launches it when the document is viewed is displayed in the PDA ID output
slash open action pedia Id also shows any embedded Flash code slash rich media rich media.
If a PDA looks suspicious we might analyze it more deeply with p with P PTF.
This tool allows us to inspect the objects and streams that form a PDA file.
Thus also any javascript code
any javascript code we execute we execute PTF on the same file with the option to launch an interactive
shell the output gives us an air because we need to specify the full path because we need to specify
the full path of the file.
Otherwise the tool does not find it.
We could see that it has 15 objects of which to which are 9 and 13 contain encoded streams.
In particular white 13 contains javascript codes
PPF also provides the feature of inspecting a particular object more deeply to do that.
We can list the commands available in the interactive shell with the help command the command to inspect
object is object.
So we execute object and we give parameter number of the object 13
the output displays the javascript code that very likely contains a shell code
other very popular document formats are and this office ones call me Linux does not provide tools specifically
created to analyze these files.
XXIV tool also works with these types of files.
We can execute it on a simple word format on a simple word doc file.
The output displays information like the application used to create the document and the number of pages
words characters paragraphs the title subject subject description and the number of revisions.
We can also view the meta data of an office document with libor office with liberty office opening the
document with the work program
and selecting file and then properties and selecting file then properties.
Great work in this video we looked at how to analyze files establishing establishing if there malicious
or not the type of data they contain and extracting their bed admitted data in particular we've analyzed
executive BHEL images and document files using differe tools pre-installed on Kelly Linux.
In the next video we're going to see how to create a so-called super timeline of the activities performed
on the system with log to timeline Plaxo.