## 5 Study Cases
### Red October Analysis
#### 5.1.2 Code Analysis  
At this stage of the analysis, the code is analyzed using debugging tools. In this case, according to the methodology that is being used, the dynamic analysis was carried out first and then the static analysis.  
As a conclusion within this same phase, it is experimentally proved that thanks to performing first the dynamic analysis, it is possible to know with greater accuracy how the code is developed. It will allow the analyst to optimize the static analysis and its effectiveness. Below are two aspects that confirm the above statement:  
* Identification of the use of obfuscation techniques that increase the complexity of static code analysis
* Identification of additional malware protection mechanisms such as the need for external connection to be able to be fully executed.  
The results obtained during this phase are presented below.
* Functional check. The'red_oct.bin.drop' file is checked using the 'PE Explorer' tool. However, this tool cannot unpack the file, although it provides us with the following information.  
Different entry point (00411A45) to the one shown in the classification phase (00011A45)  
Use of unconventional packaging  
File creation date 06/05/2011 7:58:13
* Dynamic code analysis. The 'Ollydbg' tool is used to develop this analysis. In the first place, it is decided to navigate through the code to obtain a generalized image and the following findings are made.  
Identification of protection measure by which it detects if the code is running in debug mode (see Figure 12)  
The point of creation of the file 'MSC.bat' previously identified in the classification phase is detected (see Figure 13)  
References to the files'scvhost.exe' and 'lhfd.gcp', mentioned in the open sources consulted, are also identified  
Access to the 'RPCRT4.DLL' library is identified that means, with high probability, that it will be used to establish the back door  
Coded messages and text strings that mention the service'sshd'  
Figure 12: Identification of protection measure.  
Finally, it should be noted that during the development of the analysis it is concluded that the quality of the dynamic analysis phase is directly proportional to the analyst's expertise. This being so, the possibility to work the methodology in different phases but well-coordinated, can facilitate the management and organization of specific teams for each phase.  
* Static Code Analysis. The disassembly tool 'IDA PRO' (evaluation version) is used to develop this analysis. This analysis has made it possible to obtain information of analyzed file structure at the level of memory locations, used functions and the relationship between them.  
The most interesting conclusion obtained after the application of the methodology is the possibility to carry out iterations between dynamic and static analysis, allowing the analyst to check the discoveries that are obtained and thus to optimize the resources and time used. The most important results obtained during this phase are presented below:  
* It is identified that within the structure of the code there is obfuscated code in each section, as well as empty memory blocks
* The use of the 'ISDebuggerPresent' function stored in the memory position '004180F0' is identified, potentially related to the protection measure detected in the previous phase (see Figure 14)  
Figure 14: _Cont._  
Figure 13: Creation of the file “MSC.bat”.