1. Part 1: Basic Analysis Chapter 1: Basic Static Techniques
Chapter 2: Malware Analysis in Virtual Machines
Chapter 3: Basic Dynamic Analysis

2. Chapter 1: Basic Static Techniques

3. Static analysis
Examine payload without executing it to determine function and maliciousness
Done via scanning content

4. File signatures Common code or data used across malware instances
e.g. embedded URL strings, decryptor code
Examples
Strings search on metadata, errors, constants
Regular expression searches
Hashing (e.g. MD5, SHA)

5. Signatures generated via analysis
Artifacts revealed by binary
Tools for dumping linked libraries
Dependency Walker, PEView, PEBrowse, PE Explorer, ldd
Look for common shared libraries (e.g. kernel32.dll, User32.dll, libc.so, etc)
Disassemblers

6. But… Astronomical growth in signatures
Coverage by a single tool is difficult
Cloud-based anti-virus
Bought by Google
But, public service that allows attacker to know when their malware has been uploaded and identified!
Can use private malware sandbox analysis (VMRay)

7. Malware counter-measures
Obfuscation
Code execution is hidden by author to make static analysis difficult
Packing
Code compressed and encrypted to completely thwart static analysis (Figure 1-4)
Code to unpack binaries is common, however
Some can be identified (PEiD)
Polymorphism and metamorphism
Code transformed into equivalent, but different form to thwart static signatures
Example: Mimikatz (Metasploit module to do weaponized credential theft on Windows)
From 54/54 (100% detection) to 4/54 when replacing ‘mimikatz’ with ‘kitikatz’ and recompiling
AV with signatures is now completely dead

8. Chapter 2: Malware Analysis on VMs Chapter 3: Basic Dynamic Analysis

9. Malware and VMs Most malware must be executed in order to analyze them
Requires a safe environment
VirtualBox, VMware
Host-only networking to monitor network traffic
Snapshots and roll-back
Record and replay execution

10. Sandboxes Simpler alternative to VMs
Behavior isolation and coarse-grained tracking of malware execution
File system activity
Registry activity
Network activity
Examples: GFI Sandbox, Norman SandBox
Always use a sandbox or VM to analyze malware

11. Don’t be like…

13. But, can be subtle FireEye anti-virus (12/2015)
Static analysis of Java byte-code via a Java decompiler (JODE) so did not run in a VM
But, did not realize decompiler executed byte code as well
Instant remote code execution
AV now *worse* than no AV

14. Monitoring execution Procmon (Sysmon)
Combines process, file, and registry monitoring to track execution behavior
Spits out XML on events, allows one to reconstruct process tree
Prochacker (
Process (memory) monitoring
Process explorer
Verify running process against the disk executable image
Determine if malicious documents are launching new processes
Regshot
Flag changes in registry

15. Monitoring execution ApateDNS Netcat Wireshark INetSim
Capture DNS requests and modify replies
More comprehensive follow-on tool..
Flare-NG
Netcat
Proxying and emulating connections
Wireshark
Packet capturing tool
INetSim
Simulate common Internet services

16. Tools in action See p. 57 in text (msts.exe)
Setup tools (process/network/registry monitoring, setup VMs, server emulation) – Fig. 3-12
Contacts web site (the textbook's) – ApateDNS
Creates new file (winhlp2.exe) – procmon
Modifies registry to autorun – regshot
Creates a mutex to ensure only a single execution – Process Explorer
Contacts a server over port 443 (https), but does not speak SSL – INetSim
Speaks a custom protocol – Wireshark

17. In-class exercises
Lab 1-1, Lab 1-2
Lab 3-2, Lab 3-4