Static Analysis Tools/Methods

Taking Notes is a MUST.

HashMyFiles

We need to do this to know if the malware or something about it is known. We try to find some ‘history’ to this malware. This makes it easy for us to know what to expect. Thus for this, we create a folder ‘Notes.txt’.

Inorder to get to know the hashes, Flare VM comes with a variety of stuff. Simply right click > HashMyFiles and you have a variety of them.

VirusTotal

Now we can see if we get something useful via VirusTotal. Searching by Hash, we get a number of viruses/malwares.

Apart from all this it provides a general overview, given details of creation, modification, etc., along with file names used, registry keys (both opened and set), processes trees, highlights, call, etc. But sometimes, VirusTotal need to get the malware to work in order to get and give better results.

DIE

Detect It Easy (DIE) is a portable application designed for binary analysis and reverse engineering tasks. It provides a user-friendly interface for analyzing executable files, libraries, and other binary formats.

So the Compiler is MSVC and Linker is MS Linker.

We can know more about file entropy from Threat Hunting with File Entropy

PE bear

Open the malware executable file in pe bear. If there is any other custom extension after ‘.exe’, remove it to have better idea and not messup with the imports.

  1. DOS Header

  1. DOS Stub

  1. Sections

  1. idata

  1. Imports

By opening KERNEL32.dll we get to know that it is importing many suspicious shit like VirtualProtect, VirtualFree, GetLastError, CloseHandle, WriteProcessMemory, CreateThread, WaitForSingleObject, etc. This is textbook shellcode injection api stuff.

Extended Functions give you the ability to specify a remote process to do it too. Eg. For Virtually Allocating to a remote process, you need to get a handle somehow, so we will see an OpenProcess function here to get an handle or can use (HANDLE)-1 if trying locally. Then you need the extended VirtualAllocEx. The diff b/w the 2 is that VirtualAlloc is for local ones and VirtualAllocEx has a handle, so it allows remote process. So since there are no ‘Ex’ (at the end) in the prev injection api, thus they are self injection api.

But this doesn’t mean that these functions will be called. These are generally imported just to make it look different.

We might have function like WIN32APIFUNCTION, which might expect 3 inputs. But we set them to

So even if we call this function, it wont make any different but still would be seen in the imports function part of KERNEL32.dll.

Similarly we can abuse ADVAPI32.dll, etc.

floss

Note that this below is color padding,

The text you provided seems to be formatted with ANSI escape codes for terminal colors. Here's a breakdown of what each part represents:

  1. [38;5;240m: This sequence indicates a foreground color change. Specifically, 38 signifies that the following codes are for foreground color, 5 indicates that the color will be specified using 8-bit color mode, and 240 specifies the color index. In this case, color index 240 typically corresponds to a shade of gray.

  2. %s: This is a placeholder for a string value that will be inserted into the formatted text.

  3. [0m: This sequence resets the text formatting to default. It clears any color or style changes applied earlier.

  4. [: This bracket seems to be a part of the formatted text but doesn't have any specific ANSI escape code associated with it.

  5. [38;5;154m: Similar to the first sequence, this indicates a foreground color change to color index 154, which typically corresponds to a specific color.

  6. +: This is a literal character '+'.

  7. [0m]: Another sequence that resets the text formatting to default, followed by a closing bracket.

In summary, the text appears to be a formatted string with colored text using ANSI escape codes, followed by a literal '+'.

Anyways so here we seems to get some interesting stuff like

We seem to get the following from this -

Cert details

From Properties > Digital Signature > Details, we get our stuff.

View the cert, and get more details.

That’s all for Static Analysis. And our final Notes.txt looks something like this,

Lets now dive into Dynamic Analysis.

PreviousStatic AnalysisNextStatic Analysis of Sample Files

Last updated