Using a Database in the Cloud for the StaticAnalysis of Malware

October 17, 2012
Hiroki Hada
Institute of Information Security

Malware analysis techniques♣ Dynamic Analysis and Static Analysis● Static Analysis is harder and takes more time than Dynamic Analysis● Static Analysis is more exact than Dynamic Analysis● Performing static analysis when dynamic analysis is not sufficient
Dynamic Analysis
MethodExecute and trace actions
Accuracy
Not accurate
several minutes (or severalTimehours)
Performed by Automatically

Static Analysis
Read assembly codes(Theoretically) perfectMore than 1 weekManually● If necessary, a researcher must do static analysis with too much time.

1

Our proposal♣ Extracting the difference of two malware programs● To reduce the cost of Static Analysis● We use the software named "BinDiff" which is developed by H. Flake♣ BinDiff● A program is divided into some functions (This is called Call Graph)● A function is divided into some basic blocks (This is called Control
Flow Graph)● Compare Call Graph and Control Flow Graph between two malware
programs2Demonstration of BinDiff♣ Difference between two control flow graphs
12

Perfectly the same(Green)
Partly the same(Yellow)
Exsists in only No.1
(Red)
Exsists in only No.2
(Blue)

3

latest threats of malware♣ Massive malware programs have been discovered● McAfee has detected over 80 million malware so far.
(i.e. one per 1.5 sec)

McAfee Threats Report: First Quarter 2012

● The techniques of generating malware variants.
(e.g. metamorphic, polymorphic, frequency maintenance)4

Recent tendency of malware damage♣ Enhanced technique of infection● Our social infrastructure systems are under targeted-attack♣ The incident of Mitsubishi Heavy Industries (MHI)● In September 2011, 83 servers and PCs have been infected● They were infected by famous malware such as Gumblar and SpyEye● Forensic experts have researched and concluded that there was noleaks of important data

Forensic analysis after
the incident is important
MHI News Release, Nov 18, 20115

Proposed architecture① Obtaining malware sample and extracting assembly codes② Searching malware which is similar to malware sample③ Extracting difference between two malware programs. This difference isthe part to analyze④ Static Analysis (in manually)⑤ Feedback
Infected PC

Search DB for
similar malware

Feedback

DB⑤①
MalwaresampleUnpackDisassemble

Similarmalware②

Difference

Extract
difference

Static Analysis③④6

Evaluation♣ Evaluation target
Infected PC

Search DB for
similar malware

Feedback
DB

Evaluation target
UnpackDisassemble

Extract
difference(BinDiff)

StaticAnalysis♣ Evaluation measure● How many functions can we remove ?
● The aim of this architecture is to help with the manual analysis.

7Result 1♣ “SpyEye” malware● which leaks passwords and credit card information
Number ofSample
MD5 HashFunction
Sample1 523
9D2A48BE1A553984A4FDA1A88ED4F8EE
Sample2 139
D64CA15261C53279A7288616B3CB1A92● Compare two malware programsand extract the difference
Sample1

Extracting
Extracting
Difference
Difference(BinDiff)(BinDiff)
Sample2？

● Result of comparison
Number ofFunction
function
Common functions
53in sample1 and 2 (53/523=10.1%)
Only sample1470
Only sample258
Static analysis of this function canbe done effeciently
8Result 2♣ Several “SpyEye” malware● Add malware sample3 and 4 to databaseofSample Number
MD5 Hashfunction
9D2A48BE1A553984A4FDA1A88ED4F8EE
Sample1 523
D64CA15261C53279A7288616B3CB1A92
Sample2 139
DF04C2CD2B5F7E471CB0435FDB9B3014
Sample3 609
42DACFBE2E5AF0C43D17356CA76F0271
Sample4 218
Sample2Role
analysis target
in the databasein the databasein the database

Extract
Extract
Difference
Difference(BinDiff)(BinDiff)

Sample1
Sample3

Extract
Extract
Difference
Difference(BinDiff)(BinDiff)

Sample4？

Extract
Extract
Difference
Difference(BinDiff)(BinDiff)

9Result 2♣ Result of comparison
Sample2

Sample35378

Common functions
in sample3

Sample4

Sample4, 5, 6
13585(135/523=25.8%)● Using multiple malware programs, number of common functions are
improved
Functionsof Sample1

Functionsof Sample4
Functionsof Sample2
Functionsof Sample3

10

In summary● We proposed new architecture which makes static analysis moreefficient● One of the key components in this system is a similarity analysis
function which compares disassembly code of the target malware
with already known malware in the database● We think cloud system is useful to construct the malware database toshare the analysis result all over the world

11