Japan Computer Emergency Response
Team Coordination Center

電子署名者 : Japan Computer Emergency
Response Team Coordination Center
DN : c=JP, st=Tokyo, l=Chiyoda-ku,
email=office@jpcert.or.jp, o=Japan ComputerEmergency Response Team Coordination
Center, cn=Japan Computer Emergency
Response Team Coordination Center
日付 : 2015.09.08 11:48:35 +09'00'

Understanding
Malware2015/08/14 Security Camp 2015 13-D, 14-D

JPCERT/CC Analysis Center
You NAKATSURU

Notice
These training materials are used for "Security Camp2015" in Japan— Security training program for students to discover &nurture young talent— https://www.ipa.go.jp/jinzai/camp/ (Japanese only)

The training course consists of the following 2 parts— Malware, Malware analysis basics, Static analysis basics
Learning basic knowledge for malware analysis— Malware analysis
Understanding details of malware samples using staticanalysis method

The training mainly focuses on 32bit Windows malware
Some slides have display problems due to animation
Any questions and comments are welcome— Please contact us at aa-info@jpcert.or.jp

1

Copyright©2015 JPCERT/CC All rights reserved.

AgendaBasic Knowledge
Malware Analysis—Simple HTTP Bot—Banking Trojan

Bonus—Shellcode—MWS CupDiscussion

2Copyright©2015 JPCERT/CC All rights reserved.

Objectives of This Session
Understanding malware• Windows features used by malware• Implementation of "real" malware• HTTP Bot• Banking Trojan
Understanding static analysis• Difficulties and Challenges
3Copyright©2015 JPCERT/CC All rights reserved.

WindowsMalware Analysis

(recap) Malware Analysis FlowStart

Surfaceanalysis

RuntimeanalysisNoNoenough?
Yesenough?

Staticanalysis

Yes

Summarize
ResultEnd
5Copyright©2015 JPCERT/CC All rights reserved.

(recap) Analysis Process ComparisonSurfaceanalysis

Staticanalysis

Retrieve surface
information from
Overview targets withoutexecution

Executesamples andmonitor its
behavior

Read codes inbinary files andunderstand its
functionality-Activity of- File system- Registry- Process- Network

Malware’sfunctionalitye.g.
- Bot commands- Encode/decode
methods

Output6

Runtimeanalysis

Hash values
Strings
File attributes
Packer info
Anti-virus
detection info

Security
riskLowHigh

Moderate

AnalysiscoverageLow

ModerateHigh

Copyright©2015 JPCERT/CC All rights reserved.

(recap) Static Analysis Tools
CategoryNameDisassembler

IDA

Decompiler

Hex-rays
Decompiler
VB
Decompiler.NETReflector
OllyDbg

Debugger

7Immunity
Debugger

Copyright©2015 JPCERT/CC All rights reserved.

Description

Disassembles more than
50 architectures
x86/ARM binary to C
source code
Visual Basic binary to
Visual Basic source code
.NET binary to .NET
source code
World famous X86
debugger
Python familiar x86
debugger

BASIC KNOWLEDGE

8Copyright©2015 JPCERT/CC All rights reserved.

PE (Portable Executable) File Format
https://msdn.microsoft.com/enus/windows/hardware/gg463119.aspx
Consists of headers and multiple sections, will be
extended on memory—Header: File Information
PE header
Entry point
Timestamp
Section’s infoetc.

—Section: Byte code, data

Section 1.text (code)
Section 2.rdata (data)
Section 3.data (data)

9Copyright©2015 JPCERT/CC All rights reserved.

EXE & DLL"EXE" and "DLL" are 2 most common file types in
PE (Portable Executable) file format—"Characteristics" of PE header

EXE
Portable Executable

File Format
Summary

Independent
application fileCollection of functions asshared library

Exampleexplorer.exe, iexplore.exe

kernel32.dll, shell32.dll

Executetiming

10DLL• Main function• when the file is
executed

Copyright©2015 JPCERT/CC All rights reserved.

• Main function• when the DLL isloaded/unloaded• when a threadstart/exit• Exported function• when is calledProcess & Virtual Memory
4GB per process (32bit Windows)—User space 2GB
allocated for each process, able to access each other—Kernel space 2GB
shared with all processes
00000000

80000000FFFFFFFF
11Process A
User space• Application code
• Various DLL code
• Stack, Heap
• etc.

Process B
User space• Application code• Various DLL code
• Stack, Heap
• etc.

Kernel Space• Windows kernel• Device driver• Page pool• etc.

Copyright©2015 JPCERT/CC All rights reserved.

Finding Main Function
Windows executable binary file will be started
with initial processing to launch the process
To find main function

Understand its initialization routine• Compile & Disassemble your program

Use tools• OllyDbg / Immunity Debugger• IDA Starter/ProUse your sixth sense• Based on your experience
12Copyright©2015 JPCERT/CC All rights reserved.

Important Points
Do not read everything• Time is money• Remember "efficient code analysis"
Analysis is not our purpose• Wrap up analysis results for incident
response/information sharing• Analysis report/note• Commented IDB file
13

Copyright©2015 JPCERT/CC All rights reserved.

Malware Analysis

LET'S ANALYZESIMPLE HTTP BOT
14

Copyright©2015 JPCERT/CC All rights reserved.

Analysis Target
A kind of HTTP bot spread through mass emails

malware_sample1.idb

15

Copyright©2015 JPCERT/CC All rights reserved.

Exercise 1. Malware Analysisi.

Describe the following points of the target—Details of each bot command—Decode method
Try to decode malware_sample1_data.bin

ii. Make your IDB—Fill in information that you analyzed

16Copyright©2015 JPCERT/CC All rights reserved.

Point 1. AutoRun Function
Want to launch after rebooting the OS—Copy itself into start up folder—Add a registry entry to AutoRun part
Registry entries related to AutoRun
HKCU¥SOFTWARE¥Microsoft¥Active Setup¥Installed Components
HKCU¥SOFTWARE¥Microsoft¥Windows
NT¥CurrentVersion¥Windows¥Run
HKCU¥SOFTWARE¥Microsoft¥Windows
NT¥CurrentVersion¥Winlogon¥Shell
HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run
HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥RunOnceetc.
17

Copyright©2015 JPCERT/CC All rights reserved.

Point 2. Hiding API nameGetting API address using GetProcAddress

18

Copyright©2015 JPCERT/CC All rights reserved.

Point 3. HTTP Communication
There are many ways to communicate using HTTP
WinINet APIs
• InternetOpen, HttpSendRequest, ...
WinSock APIs
• socket, connect, send, recv, ...
WinHTTP APIs
• WinHttpConnect, WinHttpSendRequest, ...
etc.
• URLDownloadToFile, …
19

Copyright©2015 JPCERT/CC All rights reserved.

Point 4. Encoding (Obfuscation)
Encode (encrypt) data to avoid being easily found—Strings stored in the binary
File name, Registry entry name, Server address—PacketVarious methods are available
Methodxor (exclusive or)
ror/rol (rotate right/left)
base64
RC4AES
20

Copyright©2015 JPCERT/CC All rights reserved.

Example'a' ^ 0x05 = 'd'rol 'a', 1 = 0xC2
-Point 4. Encoding (Obfuscation)e.g. HTTP packet obfuscation—Data encoded using "xor" or "ror/rol" may became
non-ASCII—Combination with base64 encoding is a commonapproachmake text data

xor/ror/rol encode

text databinary database64 encode21

Copyright©2015 JPCERT/CC All rights reserved.

Send datatext data

Point 5. Bot command
Bots are capable to communicate with C&C
servers to get commands to work
Receivecommandcomparecomparecomparecompare

22

Send results
match
match
match
match

Copyright©2015 JPCERT/CC All rights reserved.

Information theft
Download & exec
Key logging
Remote shell

Exercise 1. Malware Analysisi.

Describe the following points of the target—Details of each bot command"upload_": Download file from arbitrary URL"uploadexec_": Download & execute file"xxx_": Execute arbitrary shell command(Remote shell)"xxxx_": Upload specific file to C&C server—Decode method
Try to decode malware_sample1_data.bin
Wide char -> Multi byte char -> xor 0x53

ii. Make your IDB—Fill in information that you analyzed
23

Copyright©2015 JPCERT/CC All rights reserved.

Malware Analysis

LET'S ANALYZE
BANKING TROJAN
24

Copyright©2015 JPCERT/CC All rights reserved.

Analysis Target
Dropper + Tinba

malware_sample2.idb

Drive-by-Download
attackmalware_sample3.idb
25

Copyright©2015 JPCERT/CC All rights reserved.

Exercise 2. Malware Analysisi.

Analyze position independent data addressing in"malware_sample3.idb"

ii. Analyze "malware_sample_clean.idb" anddescribe the following points of the target—How to avoid anti runtime analysis technique—Installation flow
—Target web browseriii. Make your IDB—Fill in the information that you analyzed

26

Copyright©2015 JPCERT/CC All rights reserved.

Point 1. Dropping Files
Create another file
—Dropped files usually contains the main function forthe attack

2 common methods

Download from the server• Downloader
Store drop files in programs• Data / resource / overlay• Usually encoded
27

Copyright©2015 JPCERT/CC All rights reserved.

Point 1. Dropping Files
Dropping file from resource
1. Find and load the encoded
data from resourcesn FindResourcen LoadResourcen SizeofResourcen LockResource
2. Decoden HeapAlloc
n RtlDecompressBuffer
3. Write decoded data to the filen CreateFilen WriteFile
n CloseHandle
28

Copyright©2015 JPCERT/CC All rights reserved.

MalwaredecodedmalwarePE header.code.data.rsrc
encodedmalwaremain.exe

Point 2. Position Independent Data Addressing
Push strings using CALL instruction

Push address of "ntdll" &jump to next instruction

29

Copyright©2015 JPCERT/CC All rights reserved.

Point 3. Anti Runtime Analysis
Some types of malware are clever enough todetect analysis activity—To avoid analysis by malware analysts

Debugger

VirtualMachineAnalysistools

OthersBreakpoints

Interface

Window
nameComputer
name

Exception
handlingCPUbehavior

Modulename

Disk size

Supporttools
30

Copyright©2015 JPCERT/CC All rights reserved.

Cursorposition

Point 4. Code Injection
Method to execute arbitrary code in anotherprocess
MalwareTargetOpen the target
process

malware.exe

Write
Createremote thread

DLLs

31target.exe

Copyright©2015 JPCERT/CC All rights reserved.

codeDLLs

Point 5. API Hooking
Method to execute arbitrary code when API iscalled—Logging/Modifying parameters passed to APIs
target.exe

target.exe

IATIAT
code

32

DLLs

DLLs

BeforeAfter

Copyright©2015 JPCERT/CC All rights reserved.

Exercise 2. Malware Analysisi.

Analyze position independent data addressing in"malware_sample3.idb"

ii. Analyze "malware_sample_clean.idb" anddescribe the following points of the target—How to avoid anti runtime analysis technique
Mouse cursor checking, Disk cylinder checking—Installation flow
See "aa_install_as_speechengines" function—Target web browser
Internet Explorer, Firefox, Chrome, Maxthon

iii. Make your IDB—Fill in the information that you analyzed
33

Copyright©2015 JPCERT/CC All rights reserved.

Bonus:Shellcode Analysis

BASIC KNOWLEDGE

35

Copyright©2015 JPCERT/CC All rights reserved.

(recap) Exploiting Vulnerability

AttackVulnerability• Buffer overflow,etc.
• Take control
and executearbitrary code
36

Copyright©2015 JPCERT/CC All rights reserved.

Executearbitrarycode• Shellcode formalwareexecution• Malware

What Shellcode isCode snippet that is executed after exploitinge.g. Stack based buffer overflow + Heap spray
MemoryStackStack

Target37

Application

Vulnerable
function’s frame

nop
Shellcode
nop
Shellcode
nop
Shellcode

Old EBP
Target Address
Returnaddress
Arguments

Copyright©2015 JPCERT/CC All rights reserved.

Comparison With Executable File
Executable file

ShellcodeFormat

PE file format(header, code, data,etc.)

Code only

Load address

Specified at PE
headerN/AAPI address

PE loader will
resolve API address

N/A

Shellcode has some routines
to retrieve these addresses
38

Copyright©2015 JPCERT/CC All rights reserved.

Basic Process of Shellcode

Specify
its baseaddress

39

Decodeits mainpart

Copyright©2015 JPCERT/CC All rights reserved.

Dropmalware
Get APIaddresses• Stored inthe file
• Download

Executemalware

TIB & PEB
Thread Information Block (TIB)• Also called "Thread Environment Block (TEB)"• Contains thread related information• Thread context, PEB, etc.
Process Environment Block (PEB)• Contains process related information• PID, Loaded modules, etc.

Used by shellcode to resolve API address
40

Copyright©2015 JPCERT/CC All rights reserved.

TIB in Segment Register
FS register points to TIB

41

Copyright©2015 JPCERT/CC All rights reserved.

Loading to IDA
Load as a 32bit code
Recommendation—Change loading offset to 0x00010000 to avoid
analysis failure (in some cases)

42

Copyright©2015 JPCERT/CC All rights reserved.

Shellcode Analysis

LET'S ANALYZE

43

Copyright©2015 JPCERT/CC All rights reserved.

Analysis Target
Shellcode cropped from memory dumpMemoryStackApplication

nop
Shellcode
nop
Shellcode
nop
Shellcode

44

Copyright©2015 JPCERT/CC All rights reserved.

bonus_sc.idb

Point 1. Getting Base Address
To calculate relative address

Jump to next instruction• call $+5
push return
address
Get return address fromstack• pop ebp

Calculate base address• sub ebp, 0Dh
45

Copyright©2015 JPCERT/CC All rights reserved.

Point 2. GetProcAddress
Step 1: getting base address of kernel32.dllPEB• fs:[eax+30h]

Ldr• [eax + 0Ch]

InInitializationOrderModuleList• [eax+1Ch]
46

Copyright©2015 JPCERT/CC All rights reserved.

Point 2. GetProcAddress
Step 2: parsing DLL file to get API address
MZNTOptionalHeader

ExportDirectory

DataDirectories+3Ch+3Ch+78h47

Copyright©2015 JPCERT/CC All rights reserved.

Stored address ofExport Directory at thehead

Point 2. GetProcAddress
2 methods to obtain API addresses

Get all API address manually• Parse DLL file every time
• Compare export function name with
API to use
Use GetProcAddress• Use GetProcAddress after gettingaddress of GetProcAddress
48

Copyright©2015 JPCERT/CC All rights reserved.

FYI. API Hashing
Recent shellcode use hash value of API name foranti-virus/analysis

See: http://blog.fireeye.com/files/win32_api_hash_table-2.html
49

Copyright©2015 JPCERT/CC All rights reserved.

Discussion

Questions?