AVLeak:

Fingerprinting Antivirus Emulators
For Advanced Malware Evasion
Alexei Bulazel@av_leakAugust 3, 2016

Black Hat 20161

Outline
1. Introduction
2. Background3. AVLeak
4. Results & Demo
5. Conclusions
More content than I can fit in a 25 minutebriefing available in extra slides published
online. USENIX WOOT ’16 publication also
out next week.
August 3, 2016

Black Hat 20162

Problem• Automated dynamic analysis (aka “sandbox analysis”) isessential against 1,000,000+ new pieces of malware per day• Malware can behave benignly to avoid detection if it candetermine that it’s being analyzed– Over 80% of malware exhibited evasive behavior in 2nd
half of 2015
• Extensive prior work on detecting traditional emulators andvirtual machines: VMWare, QEMU, Xen, VirtualBox, Bochs, etc• Little prior work on consumer AV emulators
August 3, 2016

Black Hat 2016

3

Motivation• Consumer AV emulators are intuitively easy to evade• But… no one has demonstrated a good approach• Existing methods to extract fingerprints from emulators
are inefficient:– Reverse engineering• Too hard
– Black-box dynamic analysis• Too slow
• Our goal: Automate and accelerate fingerprint discovery
August 3, 2016

Black Hat 2016

4

AVLeak• Novel tool for researchers to easily andquickly extract fingerprints fromconsumer antivirus emulators in order toevade malware detection

August 3, 2016

Black Hat 20165

Outline
1. Introduction
2. Background3. AVLeak
4. Results & Demo
5. Conclusions

August 3, 2016

Black Hat 20166

Fingerprinting Analysis Systems• Environmental artifacts– Hardcoded strings for username/computer name/environment
variables, file system, registry entries, processes• OS API inconsistency– Functions that fail, return hardcoded values, generally don’t
behave correctly• Network emulation– Inconsistencies with real network behavior, hardcoded
responses to network traffic• Timing– Timing skews, dilation, inconsistencies across observations• Process Introspection– Internal process traits - uninitialized memory, data left on stackor in registers after function calls, PEB/TEB, DLLs in memory• CPU “Red Pills”– Instructions which behave differently on an emulated CPU

August 3, 2016

Black Hat 20167

Traditional Malware Sandbox

Many attack points, can look at open source implementations

August 3, 2016

Black Hat 20168

Consumer AV Emulator

August 3, 2016

Black Hat 20169

Consumer AV Emulator
Totally opaque, only output isanalysis reportAugust 3, 2016

Analysis report:
Dropped: Trojan.Infector.BAT.ABC123
Dropped: APT1337.Backdoor.2
Dropped: CryptoLocker.Downloader.K

Black Hat 20169

Prior Approaches: Mutation• Mutate a binary with packers
and obfuscators to avoid
detection• Requires no knowledge of AV
internals• Pentester-focused, often pack
Metasploit payloads: VeilEvasion, SideStep, peCloak,
etc…
August 3, 2016

Black Hat 201610

Reversing AV Emulators• Time consuming• Expensive tools• Expert knowledge– RE, AV, x86,
Windows internals,
malware behavior,anti-analysis• Limited Lifespan frequent updates
August 3, 2016

Black Hat 201611

Prior Approaches: Black Box Testing• Find emulator fingerprints for targeted evasion• Prior approaches - single true/false query per run– Arne Swinnen & Alaeddine Mesbahi - One Packer
To Rule Them All (Black Hat ’14)
– Kyle Adams - Evading Code Emulation (BSidesLV’14)– Daniel Sauder - Why Antivirus Software Fails(DeepSec ’14)
– Emeric Nasi - Bypass Antivirus Dynamic Analysis(white paper ‘14)
August 3, 2016

Black Hat 201612

Prior Approaches: Black Box Testing
Question: Does the emulator
emulate function_x() correctly?

August 3, 2016

AV Emulator

Black Hat 201613

Prior Approaches: Black Box Testing
Question: Does the emulator
emulate function_x() correctly?

AV Emulator

if function_x() != EXPECTED:DropMalware()else:
Exit()

MalwareTRUENo Malware FALSE

August 3, 2016

Black Hat 201613

Prior Approaches: Black Box Testing
Question: Does the emulator
emulate function_x() correctly?

AV Emulator
if function_x() != EXPECTED:DropMalware()else:
Exit()

if function_x() != EXPECTED:DropMalware()else:
Exit()

MalwareTRUENo Malware FALSE

August 3, 2016

Black Hat 201613

Prior Approaches: Black Box Testing
Question: Does the emulator
emulate function_x() correctly?

AV Emulator
if function_x() != EXPECTED:DropMalware()else:
Exit()

if function_x() != EXPECTED:DropMalware()else:
Exit()

MalwareExit()TRUE

No Malware FALSE

MalwareDetected(function_x() not
emulated correctly)

August 3, 2016

Black Hat 2016

No Malware Detected(function_x
emulated correctly)
13

Outline
1. Introduction
2. Background3. AVLeak
4. Results & Demo
5. Conclusions

August 3, 2016

Black Hat 201614

AVLeak• Tool and API for extracting
fingerprints from AV emulators withadvanced automated black box
testing• Use malware detections to exfiltratespecific byte values per run• C and Python– Python API• Find fingerprints in seconds not hours
August 3, 2016

Black Hat 2016

Virus
Database

A Morris
B Code Red
C Zeus…
a Conficker…
z Brain15

AVLeak’s Innovation
Map malware
samples tobyte values

August 3, 2016

AV Emulator

username=“emu”

Black Hat 201616

AVLeak’s Innovation
Map malware
samples tobyte values

AV Emulator

username=“emu”

GetUserName()

A Morris
B Code Red
C Zeus…
a Conficker…
z BrainAugust 3, 2016

Black Hat 201616

AVLeak’s Innovation
Map malware
samples tobyte values

Question: What is the username in the emulator?
AV Emulator

username=“emu”

GetUserName()

A Morris
B Code Red
C Zeus…
a Conficker…
z BrainAugust 3, 2016

Black Hat 201616

AVLeak’s Innovation
Map malware
samples tobyte values
GetUserName()

A Morris

Question: What is the username in the emulator?
AV Emulator

username=“emu”
for c in GetUserName():Drop(MalwareArray[c])B Code Red
C Zeus…
a Conficker…
z BrainAugust 3, 2016

Black Hat 201616

AVLeak’s Innovation
Map malware
samples tobyte values
GetUserName()

A Morris

Question: What is the username in the emulator?
AV Emulator

username=“emu”
for c in GetUserName():Drop(MalwareArray[c])B Code Red
C Zeus…

ea Conficker…
z BrainAugust 3, 2016

Black Hat 201616

AVLeak’s Innovation
Map malware
samples tobyte values
GetUserName()

A Morris

Question: What is the username in the emulator?
AV Emulator

username=“emu”
for c in GetUserName():Drop(MalwareArray[c])B Code Red
C Zeus…

ema Conficker…
z BrainAugust 3, 2016

Black Hat 201616

AVLeak’s Innovation
Map malware
samples tobyte values
GetUserName()

A Morris

Question: What is the username in the emulator?
AV Emulator

username=“emu”
for c in GetUserName():Drop(MalwareArray[c])B Code Red
C Zeus…

emua Conficker…
z BrainAugust 3, 2016

Black Hat 201616

AVLeak’s Innovation
Map malware
samples tobyte values
GetUserName()

A Morris

Question: What is the username in the emulator?
AV Emulator

username=“emu”
for c in GetUserName():Drop(MalwareArray[c])Malware Detected:
Sasser
//‘e’
Bagle
//‘m’
Blaster //‘u’

B Code Red
C Zeus…

emua Conficker…
z BrainAugust 3, 2016

Black Hat 201616

AVLeak’s Innovation
Map malware
samples tobyte values
GetUserName()

A Morris

Question: What is the username in the emulator?
AV Emulator

username=“emu”
for c in GetUserName():Drop(MalwareArray[c])Malware Detected:
Sasser
//‘e’
Bagle
//‘m’
Blaster //‘u’

B Code Red
C Zeus…

emuusername=“emu”

a Conficker…
z BrainAugust 3, 2016

Black Hat 201616

AVs Tested• Tested fourcommercial AVs
found on VirusTotal– Varying levels of
quality– Bitdefender licensed to 20+
other AVs!
– Installed locallyin isolated VM
August 3, 2016

Black Hat 201617

Outline
1. Introduction
2. Background3. AVLeak
4. Results & Demo
5. Conclusions

August 3, 2016

Black Hat 2016

18

DEMO

August 3, 2016

Black Hat 201619

Environmental Artifacts• argv[0]:• Hardcoded- K: C:\{random letters}.exe
program names,- AVG: C:\…\mwsmpl.exe
computer- BD: C:\TESTAPP.EXE
names, product- VBA: C:\SELF.EXE
IDs, MACs, etc• GetComputerName():• Fake processes- K: NfZtFbPfH“running” and- AVG: ELICZ- BD: tz
open windows
August 3, 2016

VBA: MAIN

Black Hat 201620

File System & Registry• Used API to recursively dump FS and registry• BD: A_E_O_FANTOMA_DE_FISIER_CARE_VA_SA_ZICA_NU_EXISTA (Romanian:“this is a ghost file which will tell you [that] it doesn’t exist.bat”),
TZEAPA_A_LA_BATMAN.EXE (“Batman’s Spike.exe” [with Romanian keyboard
specific misspelling]), C:\\BATMAN, NOTHING.COM• Kaspersky FS (random flailing on a QWERTY keyboard): C:\\Documents andSettings\Administrator\My Documents\{koio.mpg, muuo.mp3,
qcse.xls, dvzrv.rar, rpplL.jpg, siso.xlsx, iykk.doc …}- STD_OUTxe, Dummy.exebat, welcome.exe, Arquivos de programas• Kaspersky file headers: <KL Autogenerated>• Fake installs of other AV products, file sharing clients, games• AVG Product ID: “76588-371-4839594-51979”• Far Manager installs in Kaspersky and VBA- “Far Manager … for former USSR countries… as freeware…”
August 3, 2016

Black Hat 201621

Other AV Products• Kaspersky has installs for 20+ other AVs– Agnitum, AntiVir PersonalEdition Classic, eMule, Eset,
FSecure Internet Security, Kaspersky Lab (3 different
versions), KAV6, McAfee, mcafee.com, Messenger, Network
Associates, Norton AntiVirus, Norton Internet Security, QIP,
Rising, Sygate, Symantec, Symantec AntiVirus, Tencent,
Trillian• Bitdefender AV installs– Anti Virus, Bitdefender (4 different versions), Complus
Applications, F-PROT95, Grisoft, Inoculate, Kaspersky Lab,
McAfee, Network Associates, Norton Antivirus, Panda
Software, Softwin, Symantec, TBAV, Trend Micro, and ZoneLab
August 3, 2016

Black Hat 201622

Network Emulation• Kaspersky, AVG, and Bitdefender emulate
network connectivity• Respond with success to invalid internet
queries• Downloaded executables from all three
after HTTP connections– Reverse engineered to find more artifacts– Probably a way of “baiting” malware
August 3, 2016

Black Hat 201623

Hardcoded Start Times• Kaspersky: 11:01:19, July 13, 2012
• AVG: 1:40:41.16, May 23, 2011
• VBA: 1:31:12.123, November 3, 2014
– GetSystemTimeAsFileTime: 0:0:0.00,
0/0/2000• Bitdefender:– GetSystemTimeAsFileTime: 0:0:0.00
January 1, 2008
– GetSystemTime doesn’t work!
– NtQuerySystemTime doesn’t work!
August 3, 2016

Black Hat 201624

Process Introspection• Heap metadata, addresses, periodicity of allocations• Contents of uninitialized memory• Process data structures - PEB, TEB, etc• Process size
• Data left on stack after function calls– Second Part To Hell’s - “Dynamic Anti-Emulation
using Blackbox Analysis”• DLLs in memory after LoadLibrary()

August 3, 2016

Black Hat 201625

Fake Library Code• Fake library code in all four AVs• GetProcAddress() - dump bytes atreturned pointer• Obscure or excepting instructions are used
to trigger library function emulation when
picked up by CPU emulator

August 3, 2016

Black Hat 201626

AVG Codemov edi, edi; WinAPI hot patch point
push ebp; function prologue
mov ebp, esp; function prologue
nop
lock mov ebx, 0xff(1b lib #)(2b function #)pop ebp; function epilogue
ret (size of args) ; stack cleanup
nop…

August 3, 2016

Black Hat 201627

CPU Red Pills• Save CPU state before, run
instruction, save CPU state
after• Denial of service with
unimplemented instructions• Interesting area for continued
research

August 3, 2016

Black Hat 201628

Outline
1. Introduction
2. Background3. AVLeak
4. Results & Demo
5. Conclusions

August 3, 2016

Black Hat 201629

Common Themes• Extremely simple detection methods are
sufficient for evasion• Hardcoded environmental artifacts clearly
from programmers• Attempts to “bait” malware• Lack of heuristic malware classification foremulation-detection behavior– Kaspersky does a little bit with its
detection of in-memory DLL scanning
August 3, 2016

Black Hat 201630

Low Budget Malware Discovery• Advanced malware
authors are alreadyusing these artifacts

August 3, 2016

Black Hat 201631

Malware Insights - EvilBunny• EvilBunny (Animal Farm
APT) was evading
Bitdefender in 2011
• “TESTAPP” = processname in Bitdefender- Kaspersky?

• Discovered by
Marion Marschalek
August 3, 2016

Black Hat 201632

Evasion• AVLeak-derived fingerprints make it
extremely easy to evade detection• 100% evasion rate in testing

August 3, 2016

Black Hat 201633

Future Work
• More emulators,
more tests• Use AVLeak forvulnerability
research against
emulators (breakout
exploits)– See Tavis
Ormandy andJoxean Koret’s
work
August 3, 2016

Black Hat 201634

Conclusion• Pushed the state of the art in emulator
fingerprinting• Presented a survey of emulator
fingerprints across six categories• Demonstrated real world examples of
malware exploiting these fingerprints• Discussed directions in future researchAugust 3, 2016

Black Hat 201635

Thank You• RPI Research Team:• Help & Inspiration:– Jeremy Blackthorne – Marion Marshalek– Andrew Fasano– Rolf Rolles– Patrick Biernat– Alex Ionescu– Dr. Bülent Yener– Bruce Dang
– Dr. Greg Hughes– Dr. Sergey Bratus

August 3, 2016

Black Hat 201636

Questions?

Blackthorne, Bulazel, Fasano, Biernat,
and Yener - “AVLeak: Fingerprinting
Antivirus Emulators Through Black Box
Testing” published next week at 10th
USENIX Workshop on Offensive
Technologies (WOOT ’16)

@av_leakKaspersky Lab - Packin’ The K

More content than can fit in a 25 minute briefing
available in extra slides published online.
August 3, 2016

Black Hat 2016

37

BACKUP SLIDES& ADDITIONAL CONTENT
August 3, 2016

Black Hat 2016

38

Additional Slides• Bibliography & Further Reading• Additional Attacks• Function Emulation• Malware Discovery• Software Engineering

August 3, 2016

Black Hat 201639

For a more thorough exposition of AVLeak, check out our WOOT ’16
paper: Blackthorne, Bulazel, Fasano, Biernat, and Yener - “AVLeak:
Fingerprinting Antivirus Emulators Through Black Box Testing”
https://www.usenix.org/conference/woot16/workshop-program
August 3, 2016

Black Hat 201640

Joxean Koret & Elias Bachaalany
The Antivirus Hacker’s Handbook• This book is awesome,everything you could
ever want to know
about AV• Wish I had a copy while
doing this research,would have answered a
lot of questions
August 3, 2016

Black Hat 201641

Prior Black-Box Testing Presentations• Arne Swinnen & Alaeddine Mesbahi, One Packer To Rule Them All,Black Hat 2014
– https://www.blackhat.com/docs/us-14/materials/us-14Mesbahi-One-Packer-To-Rule-Them-All-WP.pdf– https://www.youtube.com/watch?v=gtLMXxZErWE• Kyle Adams, Evading Code Emulation: Writing Ridiculously Obvious
Malware That Bypasses AV, BSides Las Vegas 2014
– https://www.youtube.com/watch?v=tkOtBkvS9xY• Daniel Sauder, Why Antivirus Software Fails, DeepSec 2014
– https://www.youtube.com/watch?v=oe-KPageZrI• Emeric Nasi, Bypass Antivirus Dynamic Analysis, self-published whitepaper– http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf
August 3, 2016

Black Hat 201642

Additional Presentations• Christopher Kruegel - Full System Emulation:
Achieving Successful Automated Dynamic Analysis of
Evasive Malware (Black Hat 2014) [malware evasion]• Georg Wicherski - Dirtbox, an x86/Window Emulator(REcon 2010 / Black Hat 2010) [emulating evasive
malware]• Ke Sun, Xiaoning Li, Ya Ou - Break Out of The Truman
Show: Active Detection and Escape of Dynamic
Binary Instrumentation (Black Hat Asia 2016)[interesting ideas for process introspection styleattacks]
August 3, 2016

Black Hat 201643

Blog Posts• Rolf Rolles - Memory Lane: Hacking Renovo [exploiting packed
code detection to leak data from an academic system]• Marion Marschalek - EvilBunny: Malware Instrumented By Lua[EvilBunny writeup]• Eugene Kaspersky - Emulation: A Headache To Develop andEmulate To Exterminate [rare public statements aboutemulation from Kaspersky Lab CEO and founder]• Tavis Ormandy -Analysis and Exploitation of an ESET
Vulnerability [emulator breakout exploits]• Second Part To Hell - Dynamic Anti-Emulation using Blackbox
Analysis [emulator detection through undocumented register
states, no prior access to the emulator necessary]
August 3, 2016

Black Hat 201644

Papers• Jeremy Blackthorne & Dr. Bülent Yener - Reverse Engineering Anti-Virus
Emulators through Black-box Analysis [technical report on an AVLeak prototype]• Katsunari Yoshioka, et al - Your Sandbox is Blinded [novel attack on networkconnected sandboxes]• Peter Ferrie - Attacks on Virtual Machine Emulators / More Attacks on Virtual
Machine Emulators [catalog of attacks on popular virtualization systems]• Garfinkel et al - Compatibility is Not Transparency: VMM Detection Myths andRealities [why it’s “fundamentally infeasible” to build an undetectablevirtualization system]• Kevin Hamlen et al - Exploiting An Antivirus Interface; Filiol et al - Evaluation
methodology and theoretical model for antiviral behavioural detection
strategies; Filiol - Malware pattern scanning schemes secure against black-box
analysis; Borello et al - From the design of a generic metamorphic engine to a
black-box classification of antivirus detection techniques [black box testing todiscover static signatures]

August 3, 2016

Black Hat 201645

Reversing Emulators
Rolf Rolles answered a reverse engineering Stack Exchange question one my collaborators on this research made early on
in our efforts. Following through with Rolf’s advice, we tried REing some emulators, it was extremely challenging as they
are immensely complex, and so large that IDA lags significantly and sometimes even crashes during analysis.
http://reverseengineering.stackexchange.com/questions/2805/detecting-an-emulator-using-the-windows-api

August 3, 2016

Black Hat 201646

Advanced Attacks on High End System• Traditional malware sandboxes (ie: Anubis, Cuckoo, and various high-end
enterprise network protection systems) generally run a full Windows OS install
on top of virtualized hardware (such as CPU-level hypervisors, VMware /VirtualBox, or QEMU). Malware analysis may be carried out through in-box
instrumentation in user or kernel mode, or through out-of-box system
introspection.
• These systems generally return rich analysis reports detailing specific malware
actions (ie: files created, mutexes opened, registry entries opened). Attackers
may exploit these reports to exfiltrate system fingerprints by using observed
artifacts in their actions (ie: creating a file named after an observed artifact,
thereby leaking the artifact through the analysis report).
• Further, as Yoshioka et al demonstrate in “Your Sandbox is Blinded: Impact of
Decoy Injection to Public Malware Analysis Systems” (https://www.jstage.jst.go.jp/article/ipsjjip/19/0/19_0_153/_pdf), emulator artifacts
may also be leaked through web traffic in network connected analysis systems.
Despite this vulnerability, these systems are often network connected, as
malware may not show its full behavior if run in an isolated system.
August 3, 2016

Black Hat 201647

Advanced Attacks on High End System
Sandbox fingerprints:
Username:
SndbxUsr
Usermode process: debug_process.exe
Driver:analysis_driver.sys

August 3, 2016

Black Hat 201648

Advanced Attacks on High End System
http://c2.com/mal.php?username=SndbxUsr

Sandbox fingerprints:
Username:
SndbxUsr
Usermode process: debug_process.exe
Driver:analysis_driver.sys

Analysis report:
Created file:
SndbxUsr.txt
Opened mutex:
debug_process_exe
Edited registry: analysis_driver_sys

August 3, 2016

Black Hat 201648

Specific Version Info
• Kaspersky Antivirus
15.0.2.480• Emsisoft Commandline
Scanner 10.0.0.5366(specific Bitdefender engine
version unclear - See http://
www.av-comparatives.org/
av-vendors/)• AVG 2015.0.6173• VBA Windows/CL 3.12.26.4
August 3, 2016

Black Hat 201649

AV Emulator Limitations• Run on home computers - quickly and without a lot ofmemory• Respect copyright and software licensing– No QEMU/Xen/VMWare– Can’t use real Windows OS code
• Generally poor software engineering in the AV industry– Trying to keep up with 1M+ malware samples per
day means its hard to maintain old code
– Look at Tavis Ormandy’s Project Zero work forexamples…
August 3, 2016

Black Hat 201650

OS API Inconsistency• Functions fail, return failure, cause analysis to stop,
etc…
– Don’t often return unique multibyte fingerprints,
doesn’t vastly benefit from AVLeak over priortesting schemes• Lack of permissions enforcement for FS• Clipboard manipulation• Window / GUI interaction not emulated• AVG FormatMessage()– “MID[dwMessageId in hex]”
August 3, 2016

Black Hat 2016

51

Timing Fingerprinting• GetTickCount, GetSystemTime,
GetSystemTimeAsFileTime,NtQuerySystemTime,
QueryPerformanceCounter, rdtsc, rdtscp• No need for sophisticated timing attacks• Time is another environmental artifact– Static unchanging start values• Kaspersky & AVG: attempt to be realistic• Bitdefender & VBA: totally dysfunctional
August 3, 2016

Black Hat 201652

Bitdefender Codepush 0x0
push (three byte #)call 0xffff(two byte #)add esp, 0x8
jmp 0xffff(two byte #)int3… ; Int3 instructions between functions is unique; in the Windows system DLLs I examined, nops
; were present between functions.
push 0x0060(two byte #)push 0xBF80001
ret
August 3, 2016

; ret to 0xBF80001
Black Hat 2016

53

VBA Codemov edi, edi; WinAPI hot patch pointnop
nop
jecxz $+0
;jmp ecx==0 to next instr
jmp $+0;jmp to next instr
mov DWORD PTR 0xFFF1[2 byte export #], 0x406
ret (size of args) ; stack cleanup
hlt… ; Hlt instructions between functions

August 3, 2016

Black Hat 201654

Kaspersky Code• Kaspersky would generate random bytes
per run after first few bytes of eachfunction. Looking at code would frequently
result in heuristic malware classifications.
mov edi, edi
push (address of function)(random bytes generated per run)nop…
August 3, 2016

Black Hat 2016

55

Thai Malware• Googled Windows productID found in AVG’s registry-76588-371-4839594-51979• Found AVG-evasive
malware hosted on
website for Thai school likely hacked• Contained hundreds of
AVG fingerprints
AVG function emulation• Two uploads to VT before
us since 2012
August 3, 2016

Black Hat 2016

56

AVLeak Architecture• Test cases written in C
• Write once, run anywhere against any AV• Python API to build scriptable test cases- Dynamic testing scripts- Integrate with other applications• Easy to integrate new AVs- Automated with scripts
August 3, 2016

Black Hat 2016

57

Design• AVLeak is designed to be easy to use and portable– Anyone who can write C code can write tests– Tests work against any AV• AVLeak Python code automates the process ofcompiling binaries, scanning them, andreconstructing results– AVs can detect varying numbers of dropped
malware samples per run, so it is almost
always necessary to compile multiple test
binaries
August 3, 2016

Black Hat 201658

Example Command Line Invocation$ python run_test.py k test/environment/argv0.c --printmax 100 -n 7 --nobase
KASPERSKY OUTPUT:
C:\nixav.exe
C:\ifitgx.exe
don’t run
C:\hyzglgz.exe
C:\pqxmt.exe
number of bytes to print test on host
C:\adkxkz.exe
C:\psrepsx.exe
number of times to run test
C:\cbqzqtch.exe AV to test path to code
$ python run_test.py kaev test/environment/GetComputerName.c --printmax 20
BASE OUTPUT:
WIN-PN9R6J7FCOD
KASPERSKY OUTPUT:
NfZtFbPfH
AVG OUTPUT:ELICZEMSISOFT OUTPUT:tz
VBA OUTPUT:
MAIN

August 3, 2016

Black Hat 2016

59

AVLeak Flow

Probe code in C
#include “avleak.h"
int main(
int argc,
char * argv[]){
leak(argv[0]);}August 3, 2016

Black Hat 201660

AVLeak Flow

Probe code in C
#include “avleak.h"
int main(
int argc,
char * argv[]){
leak(argv[0]);}August 3, 2016

AVLeak(Python)Black Hat 201660

AVLeak Flow
Compiler
Probe code in C
#include “avleak.h"
int main(
int argc,
char * argv[]){
leak(argv[0]);}August 3, 2016

AVLeak(Python)Black Hat 201660

AVLeak Flow
Compiler
Probe code in C
#include “avleak.h"
int main(
int argc,
char * argv[]){
leak(argv[0]);}AVLeak(Python)

Probe
BinaryAugust 3, 2016

Black Hat 201660

AVLeak Flow
Compiler
Probe code in C
#include “avleak.h"
int main(
int argc,
char * argv[]){
leak(argv[0]);}AVLeak(Python)AV

Probe
BinaryAugust 3, 2016

Black Hat 201660

AVLeak Flow
Compiler
Probe code in C
Malware Found!

#include “avleak.h"
int main(
int argc,
char * argv[]){
leak(argv[0]);}AVLeak(Python)AV

Probe
BinaryAugust 3, 2016

Black Hat 201660

Example Test Case#include “avleak.h"
int main(int argc, char * argv[]){char target[30] = {0};DWORD len=30;
GetUserName(target,&len);leak(target); // easy to use API like// printing to stdout}
August 3, 2016

Black Hat 2016

61

API
• An easy to use Python API provides
programmatic access to AVLeak• This can be used to create dynamic testingroutines, for example: recursive
exploration of file systems and registries,
programatic dumping of in memory code,
red pill testing• Can also be integrated with other libraries,
such as Capstone for in-line disassemblyAugust 3, 2016

Black Hat 201662

Example Testing Scriptfrom AVLeak import *http_flags = ["HTTP_QUERY_ACCEPT","HTTP_QUERY_ACCEPT_CHARSET","HTTP_QUERY_ACCEPT_ENCODING",... ]def test_http(av):for flag in http_flags:
result = av.leak(testfile = "HttpQueryInfo_flags.c",string = flag,
printmax = 20)
print flag, "-", result
August 3, 2016

Black Hat 201663

int main() {HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);char out[30] = {0};int count = 0;
if(hSnapshot != INVALID_HANDLE_VALUE) {PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(PROCESSENTRY32);
if(Process32First(hSnapshot,&pe32)) {do {sprintf(out,"%d %s",pe32.th32ProcessID,pe32.szExeFile);#ifdef AV //inside AV, N_AV incremented for each process
if (count == N_AV){ leak(out); exit(0);}#else //real systemleak(out);#endifcount++;} while(Process32Next(hSnapshot,&pe32));
DONE(); //we have gone through all processes, don’t scan more}
CloseHandle(hSnapshot);}}August 3, 2016

Black Hat 201664