George Mason University

Static Unknown Code Analysis

▪ Unknown Code Analysis:
▪ Static Analysis
▪ Dynamic Analysis

▪ HW4 Assigned

2
3
STATIC ANALYSIS
Unknown Code Analysis
❑ Why we do it

❑ Identify what files to expect/look for

❑ How are these files generated – static vs. dynamic linkage

❑ Learn the process and tools used for Static and Dynamic

Code Analysis

4
▪ Purpose:
▪ Understand the extent of a compromise
▪ If any, what damage was done
▪ Prevent similar attacks in the future
▪ Assess an attacker’s skill or threat level
▪ Identify # and type of intruders
▪ Prepare for a successful subject interview if you catch the attacker
▪ Determine the attacker’s goals and objectives

▪ 2 types of analysis: Static & Dynamic

5
STATIC
▪ Static Malware Analysis
▪ Signature based

▪ Examine malware without running it

▪ Reverse engineer the binary (executable) files

6
▪ Portable Executables (PEs)
▪ Windows platforms

▪ Magic number: MZ

▪ .exe – executable file extension

▪ .dll – dynamically linked library file
▪ Generally found in \Windows\System32

7
▪ Executable & Linkable Files (ELF)
▪ Linux/UNIX OS platforms

▪ Magic number: 0x7F ELF

▪ No file extension standard

▪ .so included in file extension (e.g.
libgic.s0.4) - dynamically linked
program
▪ Generally found in /usr/lib
8
▪ Mach-O Mach-O Header
▪ Apple OS systems

▪ Magic numbers: Load Commands

▪ 0xce fa ed fe 32-bit architecture
Sections in Segment 2
▪ 0xfe ed fa ce
Section 1 - _text
▪ 0xcf fa ed fe 64-bit architecture Segment 1 - __PAGEZERO
Section 2 - _stubs
▪ 0xfe ed fa cf Segment 2 - __TEXT
…
… Section E
▪ Possible file extensions:
Segment __N
▪ None, .o, .dylib, .bundle
▪ Usually found in /usr/local/bin
9
 Image source: https://tech-zealots.com/malware-analysis/pe-
portable-executable-structure-malware-analysis-part-2/

40 bytes/section header
File header
(IMAGE_DOS_HEADER)
Magic_number
E_lfanew

PE Header
(IMAGE_NT_HEADERS)
PE Signature
Machine (32- or
64-bit)
# of sections
Timestamp
Pointer to
Symbols Table
# of Symbols
Size of Optional
Header
Characteristics
(contains flag
which indicates
if file is a DLL)
Optional Header
PE or PE+
Size of code
(.text)
 ELF

Contains general
information about the file
Defines Program Segments

Includes info needed for Also known as Program headers,

linking object file(s) to which group common features, to
create a full executable. better manage loading content into
Common sections: memory
.text: code Common sections:
.data: initialized data * PT_NULL: unassigned segment
.rodata: initialized read- (usually first entry).
only data * PT_LOAD: Loadable segment.
.bss: uninitialized data * PT_INTERP: Segment holding
.plt: Procedure Linkage .interp section.
Table (~IAT) * PT_TLS: Thread Local Storage
segment (Common in statically
linked binaries).
* PT_DYNAMIC: Holding .dynamic
section. 13
*Image Source: http://www.skyfree.org/linux/references/ELF_Format.pdf
Defines Section Headers
ELF ELF
header

Looking at the
“traceroute6” binary file

ELF
Sections

14
 Source Code Assembly Code
(.c file) (.s file)

Preprocessor Compiler

Object Code
(.o file)
Executable
(.exe file) Linker Assembler

Libraries
This Photo by Unknown Author is licensed under CC BY
(.dll, .so)
This Photo by Unknown Author is licensed under CC BY-SA 15
 1. Record 4. Review the ASCII/Unicode
a. Full path/location of the suspicious a.‘strings’ command
file
b. The OS file was found 5.Is this a known malware?
c. MAC times a.Start with Google
b.https://www.virustotal.com*
2. Get digital fingerprint
6.Examine shared objects
3. Determine file type (e.g. PE, (dll’s/ldd’s)
a. PEView
.dll, elf, etc.) b. Dependency Walker
a.file c. PEiD
b.nm
c.Hexdump (Linux) or HexEdit 7.Source code review (if
(Windows)
available)
* Make sure that you have permission to release your code to 3rd party 16
 ▪‘file’ command (Linux native; ▪ nm results
Windows download from online) ▪ 1st col symbol value in hex
▪ 2nd col symbol type
▪lower case local variable
▪ ‘nm’ command – command to ▪upper case global variable
show symbols from an object file ▪ symbol types
▪ a.out is default (Assembly ▪A absolute value
OUTput file) ▪B uninitialized data section
▪ -a: all ▪C common section uninitialized
▪ nm –a bob data
▪ -l: list line numbers (may provide ▪D initialized data
▪N debug symbol
good info if program in debug
▪R read only
mode) ▪T text or code data section
▪U undefined
Or use PEiD (https://www.aldeid.com/wiki/PEiD) ▪ 3rd col symbol 17
▪ ‘strings’ command –
▪ list ASCII strings 4 characters or longer in file
▪ Win2K or later searches for Unicode (Windows)
▪ Download from Microsoft Technet (www.sysinternals.com)

What info do you think we’ll find?

18
▪ Check various sites to see if Malware has been
reported* :
▪ Google
▪ VirusTotal (VT) https://www.virustotal.com

*Must ensure you are able to share code before uploading to any online site
19
▪ Look for shared libraries or dependencies
▪ .dll’s (Windows)
▪ PEView
▪ Dependency Walker
▪ PEiD

▪ ldd’s Command (Linux/UNIX)

▪ ldd bob (some versions of ldd will run the program!
Be careful!)
▪ Objdump –p bob (better output)
20
▪ Packers – compress executables to smaller,
functional sizes but keep functionality. How?
▪ Load packed code → Unpacking and expand code →
Execute unpacked code

Why pack an .exe?

21
▪ Some Packers to consider:
▪ UPX (Ultimate Packet for Executables) is a compression
tool for Linux executables (https://upx.github.io/)
▪ Alternate EXE Packer (http://www.alternate-
tools.com/pages/c_exepacker.php?lang=ENG)
▪ EXE Stealth Packer (http://www.webtoolmaster.com/packer.htm)
▪ And others... (https://en.wikipedia.org/wiki/Executable_compression)

22
▪ Other items to ▪ Who compiled code?
consider: ▪ Unusual Entries in the PE
▪ Altered Code
▪ Functions with Little to
▪ Compressed
▪ Encrypted
no documentation
▪ XOR ▪ Functions that don’t
▪ RC-4 belong (e.g. a network
▪ Compile Date/Time call in notepad)
▪ Compiler Used
23
QUICK CHECK 1
1. What is ‘Static Code Analysis’? 4. Which command/tool will:
❑ List the basic steps. ❑ Display ‘symbols’ in a file?
❑ What information are we ❑ List all ASCII strings (≥ 4chars)
gathering? ❑ What info are looking for?

2. What types of files should we 5. If submitting a binary to an online

expect for code targeting: service, what must we ensure
❑ Windows? first?
❑ *nix
❑ MacOS 6. Would it be suspicious if a binary
file is packed? Why/why not?
3. What is e_lfanew? Name it’s
location. 24
25
DYNAMIC ANALYSIS
 Static Malware Analysis Dynamic Malware Analysis

▪ Signature based ▪ Behavior based

▪ Examine malware without ▪ Execute file on a host

running system (in a sandbox)

▪ Reverse engineer the ▪ Observe behavior within a

binary file (.exe) debugger

26
 Static Malware Analysis Dynamic Malware Analysis

▪ Signature based ▪ Behavior based

Basic

▪ Examine malware without ▪ Execute file on a host

running system (in a sandbox)

▪ Reverse engineer the ▪ Observe behavior within a

binary file (.exe) debugger

27
1. Static Analysis 5. Run unknown code and
a. Determine hypothesis of monitor intercept system
what code does calls
2. Create “sandbox” –
a. Ensure sandbox is safe – 6. Capture snapshot of
how? infected VM
3. Take snapshot of host VM 7. Analysis results and write
up conclusions
4. Initiate tools for
observation 8. If desired, revert back to
base snapshot and rerun
malware

28
▪ Security mechanism for running untrusted code
▪ Access via website, but you may be giving up proprietary company
data
▪ Available for purchase – but expensive usually
▪ Drawbacks
▪ Will run the code without command line options
▪ May be VM detectable
▪ Code may require that certain registry keys be present
▪ If code is DLL, some export functions may not run properly
▪ Sandbox OS may not be correct for the code
▪ Generally can’t tell you what the code does 29
 STEP 2: VIRTUAL ENVIRONMENT SETUP 1
VMWare Configuration

LAN Segment
Host Machine
Windows VM (victim) REMnux VM (services/network capture)

IP address: 192.168.40.1 IP address: 192.168.40.3 IP address:

Default Gateway & DNS Server: 192.168.40.3 192.168.3.1
Alternate DNS Server: 8.8.8.8

Note: different subnet

Browser DNS Request mask
Browser HTTP GET

HTTP:
DNS: 60
FTP:
fakeDNS Redirect:
HTTPS:
192.168.40.3
etc,
External Network

Source: Sikorski, M. & Honig, A, Practical Malware Analysis

https://medium.com/@Flying_glasses/dynamic-malware-analysis-lab-setup-613075f9423f 30
This Photo by Unknown Author is licensed under CC BY-NC
 STEP 2: VIRTUAL ENVIRONMENT SETUP 2
VMWare Configuration

Host Machine
Windows VM (victim)

IP address: 192.168.40.1 IP address:

Default Gateway & DNS Server: 192.168.40.3 192.168.3.1
Alternate DNS Server: 8.8.8.8

Note: different subnet

Browser DNS Request mask
Browser HTTP GET

HTTP:
DNS: 60
FTP:
Apate DNS
HTTPS:
Redirect: 127.0.0.1
etc,

External Network

31
▪ Step 2 – Use VMWare or Virtual Box to set up VM(s)
▪ 1 host system VM (base this off of your static analysis)
▪ Download necessary tools (e.g. SysInternals, Wireshark, etc.)
▪ Verify tools work (take snapshot and DO NOT RUN m.w.)

▪ Set up Fake DNS for network connections using:

▪ Separate VM/ (e.g. Ubuntu/REMux)
▪ Application on host system (e.g. Fake Net, fakeDNS, ApateDNS,
MITMProxy, etc.)

▪ Test that host VMs can communicate with Fake DNS

server/application, but not with your host machine (e.g. you can’t
make calls to the WWW and get a response) 32
▪ Step 3
▪ Take base snapshot of host VM
▪ Setup monitoring tools and apply necessary filters
▪ Windows VM – host machine
▪ Process Monitor – configure only what you want to analyze –
don’t start capture yet
▪ Process Manager (Process Explorer) – will be used to look for
changes in processes
▪ RegShot – to take snapshots and run comparison of Windows
Registry

33
▪ Step 3 (cont.) –
▪ Setup Fake Network
▪ Windows or Linux based system
▪ FakeNet or ApateDNS
▪ WireShark
▪ REMnux

▪ Step 4 – Start monitoring tools on all VMs

34
▪ Step 5 – ▪ Step 7 –
▪ Ensure Internet is ▪ Run comparative analysis of
disconnected both snapshots with RegShot
▪ Note –
▪ Execute unknown code
▪ Process changes?
▪ Observe and interact with ▪ Registry updates?
program ▪ Abnormal processes
started?
▪ Step 6 –
▪ Stop code execution ▪ Analyze network traffic
▪ Whois.com (domain lookup)
▪ RegShot – for snapshot ▪ Maxmind.com
▪ CentralOps.net (do NOT
35
click on traceroute)
▪ 05-May: HW4 Due @ 11:59PM EST

▪ 11 May: Final Exam

36
Static vs Dynamic Analysis
https://technical.nttsecurity.com/post/102efk4/detecting-malware-through-static-and-dynamic-techniques
https://www.deepinstinct.com/2019/10/29/malware-evasion-techniques-part-2-anti-vm-blog/
https://www.deepinstinct.com/2019/11/24/malware-evasion-techniques-part-3-anti-sandboxing/
Portable Executable Files
http://msdn.microsoft.com/en-us/library/ms809762.aspx
https://blog.kowalczyk.info/articles/pefileformat.html
https://blog.malwarebytes.com/threat-analysis/2014/05/five-pe-analysis-tools-worth-looking-at/

Executable and Linkable Files

https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/
https://en.wikipedia.org/wiki/Executable_and_Linkable_Format
Mach-O Files
https://redmaple.tech/blogs/macho-files/

Linux commands
https://sourceware.org/binutils/docs/binutils/nm.html
https://www.thegeekstuff.com/2012/03/linux-nm-command/
https://sourceware.org/binutils/docs/binutils/objdump.html
https://sourceware.org/binutils/docs/binutils/strings.html#strings

37
Setting up VM Sandbox
https://medium.com/@Flying_glasses/dynamic-malware-analysis-lab-setup-613075f9423f

Dynamic Analysis video

https://www.youtube.com/watch?v=C6vsdyZnPPo

REMnux (ova file)

https://remnux.org/

Text Book
* Sikorski, M. & Honig, A (2012) Practical Malware Analysis, No Starch Press Inc. (ISBN: 978-1-59327-290-6)

38