Reverse Engineering Malware
with Automated Scripts

What we found in malware analysis so far• From surface analysis:• Its file type is a dynamic link library (DLL).
• It has many export functions such as "GnrkQr". We also found that themalware was set to launch with the string "GnrkQr" by examining the output ofAutoruns.
• It imports only 4 modules: KERNEL32.dll, USER32.dll, GDI32.dll, andADVAPI32.dll.

• From dynamic analysis:• It tries to connect to "tyo1964.com:443" automatically. The server seems to bea command and control server.
• The traffic to "tyo1964.com:443" contains characteristic strings. For example,
its http header contains "X-Session", "X-Status", "X-Size" and "X-Sn".
• It uses the victim organization's private proxy server.
Copyright Internet Initiative Japan Inc.

2

What we have not found yet• We have not revealed the malware's capabilities that the attacker
could do in the incident.
• We have not known where the malware leaves evidence for executionof those capabilities on.
• If we find one of those at least, we can enhance the analysis result.
• For example, a certain RAT has a file uploading function to an infected host.
When a file is uploaded, the malware creates a file that the name ends with".tmp" temporary with the original file. If you know this by reverseengineering, you can discover the file that the attacker has sent by analyzing
the NTFS journal file with forensic analysis.

• To achieve such purposes, we should perform reverse engineering.
Copyright Internet Initiative Japan Inc.

3

What should we do next?
• We will examine APIs that the malware uses, and investigate how themalware uses them to reveal its capabilities.
• We will find characteristic strings by examining strings contained in themalware. Investigating those strings helps us to get such as mutex,
paths of related files, and protocol headers that might be effective
evidence. And we often identify the name of the malware from thoseevidence.

Copyright Internet Initiative Japan Inc.

4

Reverse engineering tools• IDA is the de facto standard tool for reverse engineering.
• We will investigate the malware using IDA's scripting capabilities.
• If you do not have a valid copy of IDA Pro, you can use IDA Evaluation
Version for exercises.

https://www.hex-rays.com/products.shtml
Copyright Internet Initiative Japan Inc.

5

Opening the malware with IDA (1)• Drag the malware and drop to the IDA color iconof the analysis VM for opening.

Copyright Internet Initiative Japan Inc.

on your desktop

6

Opening the malware with IDA (2)Functions window:
This window lists functions
parsed by IDA. If you click
one of them, IDA view will
jump to the address of thefunction.

IDA View(Graph view):
This view shows disassembly codegraphically. In this view, boxes represent"basic blocks". Those are code chunks
separated by particular instructions suchas jmp and ret.
The view makes you understand at aglance such as conditional branches andloops.
You can use the space key to toggle
between graph view and text view. Text
view simply shows flat and typicaldisassembly code.
Copyright Internet Initiative Japan Inc.

7

Examining imported APIs
• Click the "Imports view"tab.
• We have already known
APIs included in themalware by performing
surface analysis though,we examine this for the
purpose of getting usedto general IDA operations.

Imports view:
Imported APIs that the executable uses
are listed in this view. Addresses andlibrary names corresponding to those
APIs are also displayed.

Copyright Internet Initiative Japan Inc.

8

The results of the examining imported functions• The "Imports view" tab shows:• Only four libraries are imported: KERNEL32, USER32, GDI32 and ADVAPI32.
• This looks strange. Typically, Windows applications that can communicate with
TCP/IP require one or more libraries loaded that are WS2_32, WinHttp, andWinINet.
• Therefore, the malware author might use some tricks to hide libraries.

Copyright Internet Initiative Japan Inc.

9

Viewing raw strings• Press the Shift+F12 keys to open the strings window.
• By default, it shows only C-style strings. To view unicode strings, rightclick and choose "Setup...", then check "Unicode".
• A C-style string is an array of characters that uses null-terminator (\0).

Copyright Internet Initiative Japan Inc.

10

The results of the viewing raw strings• The "Strings window" shows:• We were able to find only a few strings related to HTTP headers, methods, andquery parameters.
• Because of that, the malware author might use some tricks to hide strings.

Copyright Internet Initiative Japan Inc.

11

We have found a new issue• By examining imported functions and raw strings:• API names and HTTP related strings that are actually used in the malware did
not appear.

• Why？
• Are important characters obfuscated?
• Is the malware packed? – Packing means compression and/or encryption ofexecutable code.

• Let's find the decode function on the assumption that importantstrings are obfuscated.

Copyright Internet Initiative Japan Inc.

12

The strategy to expose tricks• The typical decode function havecharacteristics of:
1. Being referenced from a lot of functions• Whenever the program uses obfuscated strings, thedecode function is called.

2. A XOR loop in the function• Using XOR is a established way of implementing
encryption and obfuscation including major encryption
algorithms.

• Let's find the function that has both of above.
• We try this way manually to understand thelogic here. Later, we will introduce several tools
such as FLOSS and IDA Scope for automating
this method.
Copyright Internet Initiative Japan Inc.

Program
Function A
Function B
Function C
Function D
Function E
Function F
Function G
Function H
Function I[1] Manyfunctionsreferring toa function.

The decode function......
......

retn......

XOR......

[2] Afunction
has a XOR
instruction
in a loop.

......
13

Finding the decode function with IDC• IDC: A C-like scripting language for automating IDA.
• IDAPython: Python bindings for IDA. This is not available for evaluation version ofIDA.
• Reference and tutorials:• https://www.hex-rays.com/products/ida/support/idadoc/162.shtml• https://hex-rays.com/products/ida/support/tutorials/idc/index.shtml• How to execute:• There are two ways to execute IDC scripts. At this time, we use former one.
• Save your script as text file, then press the Alt+F7 keys on IDA to load and execute the scriptfile.
• Press the Shift+F2 keys on IDA to open the "Script Execute" window, then write and execute
your script on the window.

• We prepared sample scripts. Let's unzip "idc.zip" on your desktop.
• We also prepared scripts written in IDAPython as "idapython.zip". If you have avalid copy of IDA Pro and are familiar with writing Python, you can use this insteadof IDC scripts.
Copyright Internet Initiative Japan Inc.
14

IDC Tutorial [1]:Enumerating functions• Let's start exercises for using IDC scripts with a easy sample.
• This script enumerates functions with the start and the end ofaddresses.
#include <idc.idc>
static main(){auto addr, end, name, ea;
addr = 0;
for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)){name = Name(addr);
end = GetFunctionAttr(addr, FUNCATTR_END);
Message("Function: %s, starts at %x, ends at %x\n", name, addr, end);}}
Copyright Internet Initiative Japan Inc.

idclab1.idc

15

IDC Tutorial [2]:Parsing mnemonics and operands• This script parses the firstfunction line by line anddisplays each mnemonic andoperand.

#include <idc.idc>

static main(){auto addr, end, name, ea, mnem, op1, op2;
Mnemonics are representations of lowaddr = 0;
for (addr = NextFunction(addr); addr != BADADDR;addr =instructions
NextFunction(addr)){level machinein assembly
name = Name(addr);
language. Those are abbreviations forend = GetFunctionAttr(addr, FUNCATTR_END);
each operation.
Message("Function: %s, starts at %x, ends at %x\n", name, addr, end);ea = addr;
mnem = GetMnem(ea);op1 = GetOpnd(ea,0);
op2 = GetOpnd(ea,1);
Message(" %x: %s %s, %s\n", ea, mnem, op1, op2);
while(ea<end){ea = FindCode(ea, SEARCH_DOWN | SEARCH_NEXT);
mnem = GetMnem(ea);op1 = GetOpnd(ea,0);
op2 = GetOpnd(ea,1);
Message(" %x: %s %s, %s\n", ea, mnem, op1, op2);}
Operands are arguments for mnemonics.
break;
Operands specify the destination and the source}
Copyright Internet Initiative Japan Inc.
16of each operation represented by mnemonics.
idclab2.idc }IDC Tutorial [3]:Adding colors and changing names• This script parses the firstfunction line by line andchanges colors (#66ccff/lightblue) for lines that contain acall instruction. It alsochanges the name of thefunction.

#include <idc.idc>

static main(){auto addr, end, name, ea, mnem;
addr = 0;
for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)){name = Name(addr);
end = GetFunctionAttr(addr, FUNCATTR_END);
Message("Function: %s, starts at %x, ends at %x\n", name, addr, end);
while(ea<end){ea = FindCode(ea, SEARCH_DOWN | SEARCH_NEXT);
mnem = GetMnem(ea);if(strstr("call", mnem) == 0) SetColor(ea, CIC_ITEM, 0xffcc66);}
name = sprintf("checked_sub_%x", addr);
MakeNameEx(addr, name, SN_NOCHECK);
break;}
idclab3.idc }Copyright Internet Initiative Japan Inc.

17

Finding XOR instructions [1]#include <idc.idc>• This script changes colors forstatic main(){auto addr, end, name, ea, mnem;lines that contain a XOR= 0;
instruction and changes names addr
for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)){of functions that contain at least name = Name(addr);
end = GetFunctionAttr(addr, FUNCATTR_END);
one XOR instruction.
ea = addr;
while(ea<end){ea = FindCode(ea, SEARCH_DOWN | SEARCH_NEXT);
mnem = GetMnem(ea);if(strstr("xor", mnem) == 0){
SetColor(ea, CIC_ITEM, 0xffcc66);
name = sprintf("xor_sub_%x", addr);
MakeNameEx(addr, name, SN_NOCHECK);
Message("Function: %s has XOR at %x(%s)\n", name, ea);}}}
idclab4.idc
Copyright} Internet Initiative Japan Inc.

18

Finding XOR instructions [2]• We found 185 functions that contain at least one XOR instruction in the malware.

• But, the purpose of some XOR instructions is to clear a register. Those are not a part of the XOR
loop in the decode function. We should filter them out.

The XOR instruction with the same operands (e.g.
xor eax, eax) means to clear the register to zero.
Press the Ctrl+F keys and type "xor" tocount functions including a xor instruction.
Copyright Internet Initiative Japan Inc.

PQP XOR Q

1

10

10101

100019Finding XOR instructions [3]#include <idc.idc>
static main(){• This script changes colors forauto addr, end, name, ea, mnem, op1, op2;
lines that contain a XOR
addr = 0;
instruction, changes names offor (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)){name = Name(addr);functions that contain at leastend = GetFunctionAttr(addr, FUNCATTR_END);
one XOR instruction, and filtersea = addr;
out XOR instructions that clear awhile(ea<end){ea = FindCode(ea, SEARCH_DOWN | SEARCH_NEXT);
register.
mnem = GetMnem(ea);if(strstr("xor", mnem) == 0){
op1 = GetOpnd(ea,0);
op2 = GetOpnd(ea,1);
if(strstr(op1,op2) == 0) continue;
SetColor(ea, CIC_ITEM, 0xffcc66);
name = sprintf("xor_nonZero_sub_%x", addr);
MakeNameEx(addr, name, SN_NOCHECK);
Message("Function: %s has XOR at %x(%s)\n", name, ea, mnem);}
Copyright Internet Initiative Japan Inc.
20
idclab5.idc}

Finding XOR instructions [4]• A number of functions containing a XOR instruction has been 58. But, this is still too many toexamine each one.
• We count references for each function called from other functions based on the initial strategy. We
can use "cross-references/xrefs" feature of IDA to do that.
In the graph view, you can press the X key at the start ofa function to display "cross-references/xrefs". It shows alist of functions that calls the function you choose.

Press the Ctrl+F keys and type"xor_nonZero" to count functions which
are renamed by the script "idclab5.idc".
Copyright Internet Initiative Japan Inc.

21

To be continued…