Paul MelsonTwo-For-One Talk:Malware Analysis for Everyone

MWA-101: Five Automated Analysis Tools You should Know

Why Do Malware Analysis?Client-side attacks that install malware are the #1 external threat.It’s not slowing down any time soon:“Symantec observed an average of 75,158 active bot-infected computers per day in 2008, an increase of 31% from the previous period.”“In 2008, Symantec created 1,656,227 new malicious code signatures. This is a 265% increase over 2007.” (Source: Symantec Internet Threat Report, April 2009)

Firewalls and Anti-Virus Have LostClient-side attacks against web browsers and e-mail go right through most firewall policiesDetection rates for current malware files by market leading anti-virus scanners are averaging 30-50%If you’re not adapting some other way, you’ve lost

Malware is Adapting QuicklyTake away Local Administrator privileges?Malware that persists in HKCU Registry keys or StartUp groupWhitelist apps with Windows Firewall?Malware that hooks into Internet Explorer plugin APIsBlock IRC at the firewall?Malware that uses encrypted HTTP/HTTPS back-channels

“But it’s just spyware, right?”In the past 2 years, we’ve found malware in the wild that:Sends hundreds of spam e-mail messages per secondGives bot “herder” full desktop remote controlSearches files in “Documents and Settings” for SSNs, credit card numbers, and saved Internet Explorer passwordsRecords all screen and text input and reports it in real-time to a server in Russia

VirusTotalhttp://www.virustotal.comUpload a suspicious file, they scan it with 40+ different anti-virus products using current signaturesPretty much everybody, except TrendMicroUseful for determining if a file is maliciousAlso for determining whether your anti-virus would detect a particular fileTake advantage of heuristic/edge products without all of the false positives in productionOK, but not great for brand new or custom malwareNot great for obfuscated exploits, better with binaries

CWSandboxhttp://www.cwsandbox.orgUpload a suspicious Windows executable, they run it in their sandbox and tell you what it didGreat for figuring out what a file actually doesIt doesn’t establish malicious vs. benign, that’s up to youRequires some detailed understanding of Windows Registry, processes, file system to interpret reportSome malware can detect this and other sandboxes, and won’t runOther similar servicesNorman SandboxJoeBox

Threat Expert http://www.threatexpert.comUpload a suspicious Windows binary, they analyze itSupports web submission, but also Windows appletMust register to submit samplesCombines the features of CWSandbox and VirusTotalAnti-virus scanFile / registry modificationsPacker identificationBrowse reports and statistics from other submitted files

Wepawethttp://wepawet.iseclab.orgUpload a suspicious PDF, HTML, or Flash file, or submit a suspicious URL and it will analyze it for malicious JavaScript.Great for working with obfuscated JavaScript where reversing and debugging is complex and time-intensive.However, some forms of obfuscation, especially in PDF and SWF files, can be used to beat it.

Comodohttp://camas.comodo.comUpload a suspicious Windows binary, they analyze it for youSimilar to CWSandboxVery fastRelatively new/unknown, so less likely to be targeted for evasion (Assuming they use technology different enough from Norman, CWSandbox)

MWA-101: Q&A

MWA-405: Unpacking PDF Exploit Payloads

PDF Files and MalwareMalware relies on two methods to installExploiting a browser vulnerabilityTricking people into running a fileAdobe Acrobat Reader is, right now, the most reliably vulnerable piece of software in the worldIt’s really hard to patch across the enterprisePredecessors:Internet ExplorerQuickTime PlayerAdobe Flash Player

They Don’t Call it Pwndobe for NothingTuesday’s Acrobat Reader security bulletinThat’s 29 unique vulnerabilities, in case you’re keeping score

PDF as an Attack VectorAcrobat Reader is executable from the web browserCalled as a browser plugin via COMThere is an IE killbit, but I dare you to use it in a businessEach version of Acrobat Reader has its own CLSID, and killbitThe PDF file format supports scripting and obfuscation JavaScriptEmbedding binary objects and scripts as streamsCompressing and encoding these streamsThese are the same things that made Flash a good attack vector, so you may have some idea as to what’s next

PDF With Malicious PayloadPDF file header including JavaScript trigger

PDF With Malicious PayloadPDF file body showing binary FlateDecode streamNote the /Filter and /Length tags

Unpacking FlateDecode Streams FlateDecode is stream compression using zlib compress()Several tools can decompress and extract the streams for youPDF Stream Inflater by Bobby Spasic (Malzilla)Not available for download anymorepdftk by Sid Steward (AccessPDF)Not specifically for malwarehttp://www.accesspdf.com/pdftk/pdf-parser.py by Didier StevensThis guy writes all sorts of awesome toolshttp://blog.didierstevens.com/programs/pdf-tools/

Unpacking FlateDecode Streams Using PDF Stream Inflater to extract FlateDecode stream

Unpacking FlateDecode Streams Viewing decoded stream containing obfuscated JavaScript

Unpacking FlateDecode Streams Pipe extracted stream through Didier Stevens’ SpiderMonkey modThe log files contain the output of the obfuscated JavaScript

Unpacking FlateDecode Streams Look! More JavaScript, but this time it’s readable.Hmmm, I wonder…

Unpacking FlateDecode Streams Oh, look, they copied the exploit from milw0rm.

Beyond FlateDecodeDifferent versions of the PDF file standard support additional forms of encoding streamsASCIIHexDecodeASCII85DecodeEncoding methods can be combined on a single streamOrder of operations matters!Two methods for extracting and decoding:Manually decode Hex stream to zlib binary stream, reinsert, resize header, basically recreating the PDF as if it only contained the FlateDecode stream, then extract with inflater.exe (this sucks, BTW)Use pdf-parser.py

Beyond FlateDecodeThis stream is encoded with ASCIIHexDecode and FlateDecode

Beyond FlateDecodeWe decode the stream and find more obfuscated JavaScript./pdf-parser.py -f boBAn.pdf | less

Beyond FlateDecodeThrow <html> and <script> tags around the obfuscated JavaScript and upload it to Wepawet

Beyond FlateDecodeOoh, second stage executable downloads!

Beyond FlateDecode - EpilogueFrom the time that I started this research to the time I wrote this presentation, Wepawet has added support for ASCIIHexDecode in PDF filesSo, yes, the hours of work I did on this can be replicated in mere seconds with only a web browserBut this underscores the ongoing arms race between security researchers and malware vendorsThat’s right, I said vendors

Some Extra Funwhois goodshoot1.comNote the goofy domain on those name servers

Some Extra FunSo we search malwareurl.com for that domain, and…

Some Extra FunYES is a crimeware system made in RussiaThis is the login page for its web console

Network DetectionEasy enough to find PDF files that use encoded streams with your IDS/IPSYour firewall and proxy logs are a good place to look, tooMost sites hosting second-stage malware are in foreign countries, especially Russia, ChinaUse language to your advantage – if your employees speak English, then documents downloaded from countries that don’t speak English could be suspicious

Network Detectionalert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"LOCAL PDF mailto exploit HTTP download"; flow:from_server,established; content:"%PDF"; nocase; content:"RI(mailto:%/"; nocase; classtype:trojan-activity; sid:9000140; rev:1;)alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"LOCAL PDF with FlateDecode stream download"; flow:from_server,established; content:"%PDF"; content:"FlateDecode"; nocase; classtype:trojan-activity; sid:90000190; rev:1;)alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"LOCAL PDF with ASCIIHexDecode stream download"; flow:from_server,established; content:"%PDF"; content:"ASCIIHexDecode"; nocase; classtype:trojan-activity; sid:90000191; rev:1;)alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"LOCAL PDF with ASCII85Decode stream download"; flow:from_server,established; content:"%PDF"; content:"ASCII85Decode"; nocase; classtype:trojan-activity; sid:90000192; rev:1;)Snort rules to detect suspicious PDF files

Network DetectionFirewall events for PDFs downloaded from countries other than the US, UK, and Canada

pmelson@gmail.comhttp://pmelson.blogspot.comSpecial Thanks to Sean KoesselMWA-405: Q&A