Win PE Analysis

PE(protable executable)
4D5A is PE signature
refer
https://en.wikipedia.org/wiki/Portable_Executable#/media/File:Portable_Executable_32_bit_Structure_in_SVG.svg

 

PE file consists
header:
DOS header:64byte,starts with magic number 4D 5A 50 00,last 4 bytes is the location of PE header
DOS stub:
PE header: 24byte, starts with magic number 50 45 00 00
optional header:224 byte 
information:96byte
data directory:128byte
sections:
code
imports
data 

 

PE file analysis
static analysis: collecting information without launching the executable file
dynamic analysis collecting information by launching the executable file


Static analysis process:
1. scan by anti-virus
2. search for string , ex: tool like process explorer or pestudio
3. analyze PE header
4. analyze import tables: list who is included, exe usually include dll
5. analyze export tables: list who include me, dll usually is included by exe

Dynamic analysis process:
1.create test environment
2.colleting information using tool
3.process of testing the malware

ps:
virus writer always observe their virus whether found in VT(VirusTotal), because VT have many virus sample
ps:
VT have most file sample database. if anomaly file hash is not in VT, it is anomaly.


ps:
Analysis by ssdeep
計算fuzzy hashes/piecewise hashes,用來找相似的檔案, 可被用來找相似結構的惡意程式
ex:
ssdeep.exe -b bar.exe > fuzzy_hash.txt
ssdeep.exe -bm fuzzy_hash.txt foo.exe

refer
http://ssdeep.sourceforge.net/


........................................................................................................................................

Common static analysis tool:
IDA Pro: disassembler and debugger tool(https://www.hex-rays.com)
PEstudio
preiscople.exe
resoucehacker
...omit... 


tool:PEstudio
function include below
indicators: build-in rule for file behavior, if severity=1 is too much, that mean it is anomaly.
virustotal: integrity VT, only submit hash, dont submit file
file header: exe header
sections: compare normal and anomaly program design,
ex: 正常的value of name = text,data ,rsrc
ex: when upx compress this file, value of name become UPX0, UPX1, UPX2
ex: if virtual size(size in memory) > raw size(size on disk) mean the file should be changed by compression (in general situcation, both are same)

entry point: identify packing(加殼)
ps: how to know packing: find count of entry point in this file
Obfuscation: 混碼
imported libraried: which api is call
imported symbols: which symbol is call,
blacklisted is that virus often call,
anti-debug is a function that virus offten anti-virus, if it is too much, it is very anomacious
deprecated mean the fuction is ready end
strings: it is like process exploerer
blacklist : is like above
debug: look "file name", it is source file ogrinally path of compile
version: file description, like detail of windows prepority
ps:
color mean risk level
ps:
若exe用底層api,此工具有很大的機會會將此顯示高風險
ex: ipconfig會使用底層api,所以會被認為是高風險


tool:preiscople 

output in text
you can look imported DLL
ex:
presicople.exe

tool:resoucehacker
it is good to analysis GUI software
function include below:
text: some message in this file
cursor: mouse icon
dialog: operation interface

.....................................................................................................................................

Common dynamic analysis tool:
OllyDbg:a 32-bit assembler level analysing debugger(http://www.ollydbg.de/)
process monitor
snadbox tool: risk is that file is open to all world
Search for strings tool
...omit... 

 

Search for strings tool
binText: read dump fileand output in text
strings.exe: sysinternals tool, read dump file and output in text

Sandbox tool
Online Sandbox
ex:
https://www.virustotal.com/zh-tw/
https://anubis.iseclab.org/
https://malwr.com/

Offline Sandbox
cuckoosandbox
Buster Sandbox Analyzer
..omit...

... 

tool: process monitor

Observation all process
1. pause by disable capture
2. observe all process

Observation one process
1:configure filter: process name is "process"
2:run particular process
3: observe the particular process
ex:
1.configure filter: process name is "notepad.exe"
2.run notepad.exe
3.observe activity of notepad

Finding which process connect to specific IP
1:configure filter: path contains < ip > , include
2:observe the particular IP using which process

 

Obsevation recommendation:
1.look regsetvalue by find "regsetvalue"
(regsetvalue write something to regrity, why? because that is dagerous)
2.looke writefile by find "writefile", then include writefile to only look writefile
3.look network to understand this exe connection ( only look tcp,udp)

 

2015-10-18 14:09:50發表 2017-05-10 14:37:26修改   

數據分析
程式開發
計算機組織與結構
資料結構與演算法
Database and MySql
manage tool
windows

unix-like
linux service
network
network layer3
network layer2
network WAN
network service
作業系統
數位鑑識
資訊安全解決方案
資訊安全威脅
Cisco security
Cisco network
Cisco layer3
Cisco layer2



  登入      [牛的大腦] | [單字我朋友] Powered by systw.net