General short overview of how do file analysis and decomposition engines work and what components do they consist of, problems associated with the domain, etc. Slides are from FSec 2012 conference.

4. • Collect as much information as possible
from files/binary objects
– Other contained files/objects
– Metadata, e.g. mobile app permissions,
geolocation, IP addresses, domains, etc.
• Strip protection layers for additional
analysis
• Do it really, really fast
• Do it at scale

5. • Forensics
• Anti-Virus
• Threat Intelligence
• ...

7. • Files can be
– Packed
– Obfuscated
– Encrypted
– Broken
• Large amounts of data to process
• Speed

9. • Consolidating metadata and files/objects
• Scheduling
• Reporting
• Communication

10. METADATA
FILES ENGINE
FILES

11. • Preprocessing
– Identification
– Initial analysis
• Analysis
– Unpacking
– Validation
• Post processing
– Consolidating metadata

12. MODULES
SCHEDULER
VALIDATION
IDENTIFICATION ANALYSIS UNPACKING
...
REPORT, METADATA, FILES

13. • Speed
• Security
• We can emulate

15. • Various identification engines
– Signature based
– Heuristics
– ...
• Problems

16. • Signatures
• Various complexity
– Simple (e.g. PEiD)
• Simple byte and wildcard matching, hash matching
• 12 ?? 56 ?8 9?
– Medium (e.g. TitanMist)
• Small Regex like subset
– High (e.g. TLang)
• Almost full fledged programming language
• Other

18. • Some parts depend on identification
• Dedicated analysis modules
• Internal/external modules

19. • Unpacking
• Validation
• Collecting metadata
• Repairing broken files