Before we head into analysing a sample, let us discuss about the scenarios of how we get to the point
of malware analysis, scenario one.
A user suspect that she has received an email which appears to be a phishing email.
The user has reported this email as phishing, and it has reached the common mailbox used by SOC team
to capture all phishing emails during analysis
you notice that this particular email has a file attachment named Invoice dot xlsx.
This will lead to malware analysis.
Scenario two.
SOC team has detected that one of the system is communicating to a blacklisted IP address, and upon
detailed inspection, they suspect that it is caused by a process which is running as
invoice dot xls dot exe .
This sample is collected Password-Protected and sent to you for malware analysis.
We have already built our Malware Analysis Lab or the sandbox, we have used tools like virtual box
as hypervisor Windows 7 operating system and downloaded all the tools necessary for basic static
analysis tools like HashCalc, Exeinfo PE, UPX, bintext and PE studio.
Now let's put these tools into action.
As a best practice, we should always collect the sample as a password-protected zip.
In the previous demo, I have already downloaded the sample onto the sandbox.
I will double check that there is no Internet connectivity by running IP configure.
If you recall, we have actually disable the network interface, I will now extract the sample, the
password most of the people used to compress a malware file is infected.
I will enter the password to extract the sample.
And here we see the invoice dot xlsx file.
As we discussed in scenario number one and two.
For a common user, it looks.
To be a simple spreadsheet file.
And when files with such names are sent to people in finance or procurement or logistics team, they
are bound to double click and open the file as they would be frequently receiving such files like invoices,
financial statement, order detail, purchase order, etc..
Because we are doing a static analysis, we have to work through this file without running it.
So first, I will tell the operating system to show the extension of files.
Immediately, we noticed that it is not an xls file, but an exe file.
And if I change the folder view to details, we get to know it is an application.
Which is obviously an executable and definitely not a spreadsheet.
This file already showing the signs of a Malware.
But let's proceed further and get the file hash of this malware.
We will use the HashCalc tool.
That we have already installed.
I have enabled MD5, SHA1, SHA256 algorithm.
We just need to drag and drop the sample onto the tool and instantly we have the hash values for each
algorithm.
Let's take this hash and check in virustotal.
Remember, we do not have Internet in the sandbox, so I have to use my host machine to do so.
Let's visit virustotal.com.
Now, I'll paste the MD5 hash of the sample in the text box here.
virus scan will tell us if this is a known malicious file and also tell us how many vendors can detect
this file as malware
In this case, it is 58 out of 72 scanners detect this as malware
Looking at the result, the file is obviously a malware file.
However, let's head back to our sandbox and continue working on the file.
Now we will submit the file to Exeinfo PE, and it surely says that it is a 32 bit executable.
And it also provides some additional details, like the sample is packed with UPX and down here, it
gives us the unpacking instructions.
Now, let us use UPX to unpack it.
Before that, I want you to take a note of the file size here.
Right now, it is 43 kb.
Now, I will move to the directory where UPX file is stored and launch a command line tool by typing
cmd in the address bar.
This will take me directly to the folder where I run the command.
As instructed by Exeinfo PE tool, to unpack the file, we need to use the command upx dot exe dash d
and supply the file name.
The extraction is successful, and if you notice, the file size is now 56 kb.
I decompress the original sample again so that we have both packed and unpacked version.
Now that we have both packed and unpacked files, let us see what difference it makes in string analysis.
As we have learned earlier, we will use bintext to do string analysis.
I will first load packed file and observe the readable strings.
So we start seeing some strings here, it starts with the contents of DOS stub, which holds the message
this program cannot be run in DOS mode.
There is a word TLOSS at this point, we are not sure what it is.
Here it says message box a, which appears to be a function.
As you see, most of these strings do not make any sense.
Here we see an http request but the url is not complete.
We also see a broken or a half part of what looks like an IP address.
Then we see a list of libraries being used and down here we see few functions.
Right now, we see a total of nine functions.
bintext repeats the whole file twice, here is the end of the file.
From this point onwards, it is a repetition of the same strings.
Throughout this packed binary file, we could hardly find any meaningful strings.
At this point, there is not much to draw conclusion about the sample.
Now, let's load the unpacked sample.
I will load the 56 kb unpacked binary file.
Right off the start, we are seeing more strings than what we saw in the packed version.
Like here, we see some error messages, plus we see Microsoft visual C++ runtime libraries being imported.
We also noticed few functions like get the last active pop up, get active window and message box a functions.
Here, all the libraries are listed, but if you notice the functions there are way more functions
we see here than what we saw in the packed file.
And now we have some HTML code embedded in the malware.
Looks like its job is to print the message your computer is in danger.
Windows Security Centre has detected spyware or adware infection.
It is strongly recommended to use special anti spyware.
Here is something more interesting.
There appears to be something like a hostname download bravesentry.com.
And here is an IP address too.
And if you see down here, it looks like our simple spreadsheet file is connecting to an url and running a
http get request.
It is accessing some registry settings in software, Microsoft Windows current version, Internet settings.
Then the same popup message looks to be appearing again.
Here we see the mention of the file in a specific path, that is C program files bravesentry and a
file is
bravesentry.exe
Further, it is accessing few more registry paths.
Down here, we noticed that it is accessing another registry path software, Microsoft Windows current
version run.
And it looks like it is adding a key value, their called install dot dat.
Which is possibly another file.
This registry path, software, Microsoft Windows Current Version Run, has a special significance which
will be discussed in later modules.
We see the same registry path again, software, Microsoft Windows current version run, but this time
with the value of C Windows Update dot exe.
Based on the string analysis, we can highlight the following details.
That the file contains some user interaction, like if it contains any inputs or outputs to the user
list of all the libraries used, functions used, network activity.
Registry values being accessed, modified, created or deleted, also files being accessed, modified,
created or deleted.
By now, we already have a pretty good picture of what this malware is possibly doing.
Now, let us see what PE studio has to reveal about this sample.
We will launch The PE studio first and then load the unpacked sample.
It'll take some time to extract all the information about the file.
Here we see the properties of the file, like file hash in various algorithms.
First few bytes in hex.
That is 4D 5A, which is the file signature for executable file.
The same is again confirmed in first few bytes in ASCII.
If it is MZ, it is an executable.
It also gives the overall file size, since we have loaded the unpacked version, it is
57,344 bytes.
We noticed the entropy value is 5.272, not very high for a malware file, but we
should remember that we have loaded an unpacked version so the level of randomness is going down,
thereby reducing the entropy value.
It says the file is an executable and the architecture is 32 bit and a compile time is May 7th, 2007.
Down here, we see all the different parts of the PE file that is DOS header, DOS stub, PE file header,
optional header and sections.
DOS stub give the expected message that is this program cannot be run in DOS mode.
file header says this file has three sections in total, which we will verify in a few moments.
It also confirms it is an executable.
As expected, the optional header gives the entry point that is the point in the memory where the code
starts.
Which is the dot text section.
Checking the details of the section, we see that the file has three sections, dot text, dot data
and dot resource.
We see the hash of each section and entropy of each section.
If you notice the permission on the dot text section, it has a right permission, which is a tell-tell
sign of a malware, that is, it is a self modifying executable.
We can also see that it is using these seven libraries.
And these 85 different functions.
Let's take a look at the resources section.
There are three resources to support this file, each of the resources, and it's a modified hash and
the entropy value is highlighted.
Also, we noticed that the dialogue appears to be in Russian.
Finally, we see all the strings here, the same information, what we got from bin text, we will
add all these details to our malware report.
The report is attached in the resource section of this lesson.
By now, we have a fair idea about the sample and by various static analysis method, it is confirmed
that it is a malware file.
We can further confirm the same during the dynamic analysis of the sample.