Malware Analysis - Simple Habits to Stop Going Down the Rabbit Hole
Channel: MalwareAnalysisForHedgehogs
Date: 2020-10-19

Rabbit holes are the arch enemy of reverse engineers. Some simple habits will help you to avoid them.
We analyse a sample that looks like a benign card game, but eventually we see the malicious needle in the haystack.
Summary at 30:17

Don't dive immediately into code, create an overview first.

To do so:
* always extract strings (IDA strings tab is no replacement)
* always check file in a hex editor
* use visualization for large files to find interesting areas
* use automated analysis reports
* along the way make notes of interesting structures, strings, characteristics, behaviour
Strings extractors and hex editor cannot be fooled that easily. They work regardless of the file type.

If you go down a rabbit hole:
* stop, take a step back, take a break
* talk to colleagues, friends or a rubber duck about it
* go back to creating an overview again
* ask for help

Follow me on Twitter: @struppigel

Any.Run: https://app.any.run/tasks/6cdbb3ea-a272-47d5-b01e-0a41a1ae16f3/

VT: https://www.virustotal.com/gui/file/c2bc9f2091a56e2d7045ddc273ba91462252f51baec6e6e62f6d0a08735564dd/community
Intezer: https://analyze.intezer.com/analyses/ad76b827-236a-46af-9fc5-1e89ddadff9c

MalwareTips: https://malwaretips.com/threads/interesting-net-malware-disassembly.102834/

Sysinternals Suite: https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite
DnSpy: https://github.com/dnSpy/dnSpy/releases
De4dot: https://github.com/de4dot/de4dot