NEXT-GENERATION OF EXPLOITKIT DETECTION BY BUILDINGSIMULATED OBFUSCATORS
Tongbo Luo & Xing Jin
Palo Alto Networks

Agenda§Background and Motivation§Challenges§

Our Approach and Lessons We learned§

Result and Our Observation

2 | ©2014, Palo Alto Networks. Confidential and Proprietary.

Motivationwww.jsDarwin.com
Similarity-based Detection on malicious Exploit Kit JavaScript

Large Number of Samples Required3 | ©2014, Palo Alto Networks. Confidential and Proprietary.

Exploit Kit Obfuscator
Malicious
PayloadReconstruct Encoder
Obfuscator
UnpackerTemplate

EVAL
Template

Identify Template From
Obfuscated Page

Encoder
Obfuscation
EngineEncoded
PayloadUnpacker

EVAL
Trigger
Obfuscated

4 | ©2016, Palo Alto Networks. Confidential and Proprietary.

Reproduce Engine Logic

Obfuscator Reverse-Engineering

window [‘e’+’v’+’a’+’l’][wsq(xyz, fxj)];
window [‘ev’+’al’][zxh(abc, sih)];window [‘aevala’.substr(1,4)][zxh(abc, sih)];Obfuscation Engine(variant)
5 | ©2016, Palo Alto Networks. Confidential and Proprietary.

“window [“ + $[eval_ctr] + “] [”+ $v[0] +”(“ v[1]+ ”,” + v[2] + ”)” + “]”EVAL Template(version)

Challenges
1. Code Complexity

Hundred lines of code
Random variables
6 | ©2016, Palo Alto Networks. Confidential and Proprietary.

Challenges
2. Data Complexity

Big data set (~20000 Samples over 2 year period)
Mixed versions and variants

7 | ©2016, Palo Alto Networks. Confidential and Proprietary.

Overview of Our Approach

8 | ©2016, Palo Alto Networks. Confidential and Proprietary.

12JavaScript
Normalization

HierarchicalClustering

3ReproduceObfuscatorJavaScript Normalization
JavaScript Source Codefunction azy ( Ag6) { return/*fdsj*/ Ag6 ; }Tokenization
TOKENS

Keywordfunction Identifier(Identifier) {KeywordreturnIdentifier

Generalization
Normalized Script§

Ignore Superficial Obfuscation (e.g. Randomized variable names)§Normalized Script ó Structure of the Code9 | © 2015, Palo Alto Networks. Confidential and Proprietary.

;}

Statistics
Total Number of samples we collected

Total Number of samples
With Unique Normalized script

function azy ( Ag6)

{returnAg6function F$x3j( k2c5x ){returnk2c5x ; }10 | © 2015, Palo Alto Networks. Confidential and Proprietary.

; }1% 2%3%
4%

36%
24%5%8%17%Angler Exploit Kit

Statistics on Normalized Samples
11 | © 2015, Palo Alto Networks. Confidential and Proprietary.

Same Day
1 Day Apart
2 Days Apart
3 Days Apart
4 Days Apart
5 Days Apart
6 Days Apart
7 Days Apart
8+ Days ApartClustering§ Goal: Cluster Samples based on their obfuscator§ Observation: Similar Structure è Generated by SimilarObfuscator§ Define Similarity.

§ Similarity Score [ 0 , 1 ]§ 1 = Identical, 0 = Different

13 | © 2015, Palo Alto Networks. Confidential and Proprietary.

Hierarchical vs Flat
§ Flat Model: (K-Means)§ Easy and Efficient§ Drawbacks§ Require predefined K as input§ K ó Number of Obfuscator Version§ Hard to Predict, lack of knowledge§ Will be Changed over time.

14 | © 2015, Palo Alto Networks. Confidential and Proprietary.

Agglomerative (Bottom-Up) Hierarchical Clustering
0.6

threshold

0.7

Dendrogram
15 | © 2015, Palo Alto Networks. Confidential and Proprietary.

2015-06-162015-05-03

2015-05-04

2015-06-07

2015-05-10

2015-05-04

0.8

What is the proper Thresholdto Identify Obfuscator Version/Variant?
[0.4 – 0.5]

[0.78 ~ 0.85]

Identify
Obfuscator
VersionIdentify
Obfuscator
Variants

Threshold vs K

Clustering Result

Nuclear Variant 1

1.1
1.2
1.3
2.1
2.2
Nuclear Variant 2
JavaScript
1 Normalization

16 | ©2016, Palo Alto Networks. Confidential and Proprietary.

2 Obfuscator
Version2.3
Obfuscator
Variant

Reproduce Obfuscator for Each Cluster
window [‘e’+’v’+’a’+’l’][wsq(xyz, fxj)];
window [‘ev’+’al’] [zxh(abc, sih)];window [l28f + i8d4][zxh(abc, sih)];

1.1
1.2
1.3

I[‘S’+‘S’+‘S’+‘S’][I(I,I)];
I[‘S’+‘S’][I(I,I)];
I[ I +I][I(I,I)];

2.1
2.2

Threshold 0.80 è80% Similar Within Cluster

Template

2.3
Obfuscator
Variant
17 | ©2016, Palo Alto Networks. Confidential and Proprietary.

Obfuscator Engine

Why This Research

BoostSamples
Set

18 | ©2014, Palo Alto Networks. Confidential and Proprietary.

ImproveDetection
Rate

BetterUnderstandingon Obfuscator

Life Cycle of Nuclear Exploit Kit Obfuscator

During December 2014, a new version ofNuclear Pack emerged. … new version willcompletely replace the old version.

websense

http://community.
.com/blogs/securitylabs/arc
hive/2015/01/15/evolution-of-an-exploit-kit-nuclear-pack.aspx

19 | © 2015, Palo Alto Networks. Confidential and Proprietary.

Life Cycle of Angler Exploit Kit Obfuscator• Extremely Prevalent• Aggressive tactics for evading detection• Only few Obfuscator Versions / Variants.

20 | © 2015, Palo Alto Networks. Confidential and Proprietary.

# of Domains Deployed
Version 1: 519
Version 2: 89
Version 3: 753
Version 4: 68
Version 5: 234

Evolution of Variants

Nuclear Obfuscator Version 2

2015/June
Variants 2

2015/May
Variants 1

0.81

2015/July
Variants 3

0.85

0.75

0.66

0.67

0.47
21 | ©2014, Palo Alto Networks. Confidential and Proprietary.

2015/August
Variants 4

TAKEAWAY§ A new Angle to Explore Exploit-Kit§ The novel method to boost sample set andimprove detection rate by reproducing obfuscator.
§ The Evolution of Obfuscator in the wild

22 | © 2015, Palo Alto Networks. Confidential and Proprietary.

Q &A

https://github.com/irobert-tluo/rebuild_obfuscator

23 | © 2015, Palo Alto Networks. Confidential and Proprietary.