## 3 Case Studies
### Third Malware
#### 3.3.2 Analysis of the Encrypted File
The (not exhaustive) list of candidate cryptosystems is presented below:  
* DES--acronym for Data Encryption Standard, the first commercial-grade encryption algorithm with open specification;
* Triple DES with 2 keys--consists in successively applying DES three times with the first key being equal to the third and different from the second one [17];
* Triple DES with 3 keys--consists in successively applying DES three times with the keys being pairwise different [17];
* FEAL--the acronym for Fast Data Encipherment Algorithm, a block cipher proposed by [PERSON] and [PERSON] [18] that uses a 64-bit key to generate a 256-bit key;
* IDEA--block cipher created by [PERSON] and [PERSON] [19] that uses a 128-bit key;
* SAFER K-64-- the acronym for Secure And Fast Encryption Routine with a Key of length 64 bits, a byte-oriented block cipher proposed by [PERSON] [20];
* RC5--created by [PERSON] [21] and designed to be fast, both in hardware and software, having a variable number of rounds and variable-length cryptographic key, and to be adaptable to architectures with different word sizes;
* Loki--cipher created by [PERSON] _et al_. [22] that employs a 64-bit key;
* Blowfish--this cipher was created by [PERSON] [23] and can use key lengths up to 448 bits; and
* KATAN64--one of the members of a family of hardware oriented block ciphers, all using 80-bit keys, created by [PERSON] _et al_. [24]. Figure 15: Message boundaries. To the best of the author's experience, among the enumerated algorithms, the most commonly used are DES, Triple DES, and Blowfish. They will hence be our first choice. In order to help in the identification of the algorithm used, we can search for strings related to the candidates in the malware binary. Thus, one should try \"encrypt\", \"crypto\", \"cipher\", \"des\", \"bf\", and \"blowfish\", to name just a few examples. The results of this step, shown in Figure 16, give us an important hint (\"LbCipher\"). Searching this word in Google, we find out that it is a library for Borland Delphi, which implements the algorithms DES, Triple DES, and Blowfish. Although we have been capable of narrowing the list of candidate algorithms, obviously that is not enough to decrypt the malware output files and we still need to identify the exact cryptosystem and key. Starting with DES, we have the following basic facts: DES is a block cipher based on a 16-round Feistel network, using a 64-bit key of which only 56 of them are effective, due to parity bits. Sixteen 48-bit round sub-keys are derived from the original cryptographic key by a scheduling algorithm, which uses two tables, PC1 and PC2, for bit selection. These tables are illustrated in Figure 17.  
Even though DES uses other structures in tabular form, such as the initial and final permutations (IP and IP\({}^{-1}\)), for example, the interest in PC1 and PC2 lies in the fact that the key scheduling algorithm is the only point in the whole algorithm where the key is referenced. Therefore, if we are able to find them inside the malware binary, besides confirming the use of this cipher, we can, as a side effect, easily locate the code that manipulates the key. Just to evidence that we are in the right track, we can check the presence of PC1 and PC2 in the source code of LbCipher, which can be obtained from the Internet. As expected, those two tables are declared as arrays in the library, as shown in Figure 18. It is important to note that, since the first position in the array is zero, all the values of Figure 17 are subtracted by one. Hence, when searching the binary for those data structures, this fact needs to be taken into consideration. Another comment regarding the  
Figure 16: Search results of common words.