## 5 Study Cases
### Red October Analysis
#### 5.1.1 Malware Classification
* It is identified that once the back door is established, an exchange of information is initiated allowing the malware to install specific modules in order to develop a precisely attack adapted to the victim. It is true that in this case, a sample of malware detected in 2012 is being analyzed, and this allows access to a lot of information that allows for being more effective during the perform of the analysis. However, it is considered that this is a great advantage of the methodology being tested. Both from the point of view of efficiency and effectiveness in the use of resources, and the possibility of increasing the degree of knowledge about malware by understanding what has already been discovered, allowing the analyst to focus on new aspects. * Strings. 'Bintext' and 'Strings' tools are used to look for text strings in the code that can be helpful to the analysis. This part of the analysis yields a lot of information that needed to be analyzed in detail. The most relevant results obtained are presented below:
* Reference identification to the Excel.exe application *
* Identification of TLS functions that can be used to avoid debuggers as well as a reference to the function 'IsdebuggerPresent'
* Identification of strings related to encoding 'Encodepointer' and 'DecodePointer'
* Sequences that may be related to memory write attempts and buffer overflow attacks (!%s)
* Identification of references to specific websites (SamLab.ws)
* Obfuscation techniques (see Figure 11). Thanks to the previous phase, it was identified that the file'red_oct.document.exploit' had almost no ASCII chains that is a potential indicator of being an obfuscated program. The 'PEiD' tool is used, but is not capable of producing any valid results. The same test is carried out with the file'red_oct.bin.drop' and interesting results are obtained. An entropy value of 6.62 is detected, which suggests that obfuscation techniques may be being used. According to the methodology, at this point it would be necessary to continue with the classification of the obfuscation techniques used, through a manual process of the packaging analysis and potential encryption of the file'red_oct.document.exploit'. Bearing in mind that the object of this analysis is aimed at verifying the applicability of the methodology presented, and getting empirical proof of the benefits it provides, it was decided not to develop the tasks of the obfuscation techniques analysis of used through manual unpacking and decryption because they require significant resources. In this way, during the following stages of the application of the methodology, the work will focus on the file'red_oct.bin.drop'. * Format and structure. We are in the last step of the classification stage and it is about analyzing the structure of the file to identify the use and the relationships between libraries, versions, dates and entry sections that may suggest that the code under analysis is a malware. During the practical exercise, the tools 'Dependency Walker' and 'PEBrowser' were used. Due to the dependence of the analysis with the tools used, in this step only the archive'red_oct.bin.drop' could be analyzed since the other file was not recognized as a PE file, limiting our analysis. Thanks to the extensive identification of modules and dependencies, it is possible to identify the following relevant aspects:  
* Identification of the use of the 'CRYPT32.DLL' library and the 'CryptStringToBinaryW' function that indicate the need to process encrypted code at runtime
* Identification of the use of the 'MPR.DLL' (multi provider router) module related to the establishment of different connections and the identification of key changes and session starts
* Identification of the use of the 'SHELL32.DLL' library, used to open different Windows components  
Finally, the risk of the archive is analyzed using the 'PEStudio' tool, which allows the identification of indicators of suspicion of the code being analyzed.