So in this video we are going to obfuscate the import strings in the file.
So malware analyst will use these p bear and other tools to do the static analysis.
So in the static analysis, the malware analyst won't run the binary file and instead he uses tools
to get the information as much as possible to understand what the program is doing.
So if I am the analyst, I will open this in behavior and of course sees the import what the import
data and the functions are.
It's the key is using.
So if I open in the normal p viewer, I can see there is a uh candidate uh 32 dot DLR and here we have
the two functions so it's our attack and exit passes as soon as I see the attack.
So something, uh, fishy is going on because, uh, it's allocating, uh, uh, some memory and exiting.
So, uh, you also have other functions.
Uh, if you wrote this, it matters by generate.
Even if you have, uh, written normally you will have uh, much more functions like create, remote
threat, etc. So as soon as the malware sees the creator moderate and all of these, uh, for hackable
uh, functions, so he immediately uh, uh, understands that this is malware.
So instead of these, uh, actual things, we can uh, obfuscate this, uh, we can use user server
for this.
So serious effort is a simple one.
So, uh, I have already, uh, wrote the code.
It's, uh, very simple.
So here we have seen these, uh, parsing the inputs in the previous video.
Now we are just, uh, uh, uh, printing out the error name.
And also we are going to, uh, use the obfuscate function.
So in this obfuscated function we will use the key as one for now.
So to get the simple understanding.
So if I go to obfuscate, uh, function, uh, it takes the plain string and the key.
So the key is, uh, the shift one.
We have uppercase, uh, characters, lowercase characters.
So you can also, uh, take the, uh, ASCII code of the character and you can add that, uh, key.
But this is, uh, my way of doing this.
Philosopher So, uh, what we're going to do is if the string is.
Oh, yeah.
BCD Now the shift is, uh, uh, one.
So what we're going to do is we are going to find the index of this capital here in this area.
So it is zero.
And I'm going to add this shift to this index.
Now, if I add plus one to this, I will get the value of one.
Now I go and fetch the element at this index in this same uppercase area.
So uppercase of one gives you B so that means, uh, the capital B is my new string new character.
So I'm going to have that one.
So the same thing applies to the, uh, other characters in the string as well.
You take B and find the index in this uppercase character.
Uh, if you found any index.
So that means, uh, uh, the index is one you want to add the shift to this, you get two and uppercase
of to use, you see.
So C is the new character.
So in this way, uh, this is a cipher works.
So we are just looping over the, uh, uh, source string and we are checking if the uppercase is equal
to matches this one.
And we are putting a flag is present too.
And then we are just using this, uh, index and index should be uh, uh, reminder operator, module
operator, uh, with this, uh, length because it should not over go about, uh, the application trend
in the same way to the logic case, uh, characters and if, uh, there is a number which is not present
in these errors, so we are just uh, appending that number to this obfuscated string.
So we will get some, uh, cipher, uh, string, and we are going to replace, uh, that old string
that is Canada with the new string that is the obfuscated, uh, uh, cipher text.
So what we're going to do is we are going to, uh, search, uh, from each byte, uh, uh, up to this,
uh, length.
So we are searching from starting to, uh, uh.
Ending and then we are going to get string for each bites and then we are comparing with this whole
thing.
If this is equal, then that means we are going to modify the weights at that old string with the new
string.
So we are modifying each character with the new string.
That is our ciphertext.
So that's it.
That's, uh, what this function does.
It's gonna create a new, uh, binary that is called character 330.
So let's, uh, run this one.
So get to the taxi and.
Now this function gonna create a new binary characteristics, so it's gonna run this.
So it's not only it's gonna pass the imports or it's exit and that's open that character, the THC.
So let's go to imports.
And here we can see some, uh, random character searching.
But here when you see the t two, you probably, uh, guess that it might be Canada, but you don't
know the functions, so it's very easy to decipher.
So if you, uh, since the key is one, you can, uh, backtrack one, uh, character.
So the previous character for L is K and for if it's C and uh, yes, it's R, so similar to like the
k e r n e l that e to that d l l so we're gonna get the generated here, uh, and in the same way for
these, uh, functions as well, if we're gonna backtrack one, uh, before, so the character before
W is V and i j r s so we get virtual arrow.
So in this way, when my analyst sees so this is not going to stop my interest from figuring out this
one, but it's going to, uh, delay my list for sure so we can use other transportation, uh, ciphers
as well.
So let's, uh, decode this one.
So let's say car three dot e c.
So what we're going to do is.
Whenever you pass this string, all you need to do is you need to, uh, uh, card this d obfuscate,
which, uh, probably disappears with the key.
So we are starting the day of a skate, uh, skate function with the key, which we are going to the
first skate function.
So there are an m so we can also de obfuscate.
After a day of skating, we can copy the, uh, same, uh, uh, the, the obfuscated names to these,
uh, addresses as well.
So if we run this.
So here we can see the, uh, the obfuscated deciphered, uh, Canada, uh, dialer and the function
names.
So after, uh.
The fascination we can write the to this passes memory.
So we have passed a lot of this in the this process memory so we can write this up updated.
Uh.
Our names to that memory.
And you can, uh, parse the base location and execute the code.
So that's how for this video, it's, uh, simple, uh, uh, trick, but, uh, it, it still, uh,
delays the model and for the static analysis.