Keith J. Jones, Ph.D. - Crash Course malware analysis
•
4 likes•336 views
The document provides an introduction to malware analysis through four main sections: defining malware and what it can do, how malware operates, challenges with analyzing the large volume of malware, and free resources for learning more about malware analysis. The author outlines the key phases of analyzing malware - intelligence searching, static analysis, dynamic analysis, and automated analysis - and provides examples of tools that can be used at each phase, such as VirusTotal, Ghidra, and Cuckoo Sandbox.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Keith J. Jones, Ph.D. - Crash Course malware analysis
Similar to Keith J. Jones, Ph.D. - Crash Course malware analysis (20)
Recently uploaded
Recently uploaded (20)
Keith J. Jones, Ph.D. - Crash Course malware analysis
- 1. Crash Course: Malware Analysis Keith J. Jones, PhD keith.j.jones@ieee.org
- 2. I hope to… • Provide a gentle introduction to malware analysis. • Provide some context behind malware analysis that may spark your curiosity to learn more. • Give you some resources so you can learn more about this exciting subject (for free!). Samuel L. Jackson, Jurassic Park 1993 Be prepared for some of my most favorite cinematic references as we discuss malware for the next few minutes…
- 4. Outline • Malware • What is it? • What can it do? • How does it do it? • How bad is it for real? • You have yourself some malware... Now what? 1. Intelligence Search 2. Static Analysis 3. Dynamic Analysis 4. Automated Analysis • Where can you learn more? • Tons of free resources! Don’t fall asleep until the next presentation! https://www.hbo.com/deadwood
- 5. Malware – What is it? • Malicious + Software = Malware • What is “malicious”? • rm –rf / • Packet sniffing • Encrypting important files • Data theft / exfiltration • Camera Hijacking • Packet forwarding • Etc, etc, etc… James Gandolfini as Tony Soprano, The Sopranos 1999-2006
- 6. Malware – What Else Can It Do?
- 7. Malware – What Else Can It Do? • https://www.informationweek.com/forensics-expert-attempts-to-link-ubs-attack- and-defendant/d/d-id/1044540 • https://www.informationweek.com/how-a-trigger-set-off-a-logic-bomb-at-ubs- painewebber/d/d-id/1044679 • https://en.wikipedia.org/wiki/Logic_bomb “In Michael Crichton's book Jurassic Park, computer technician Dennis Nedry inserted an object into the mainframe coding for the park that would shut off the entire island's power (including the supply to the electric fences) in order to steal several dinosaur embryos in the chaos.”
- 8. Malware – How Does It Do It? • Always comes back to one activity: • Something gets executed. • Executable file (PE, for example) • Weaponized document (VB scripts inside a document, for example) • Device Driver • Etc… • Usually (but not always) because the user executed it. • https://www.popularmechanics.com/technology/apps/news/a18837/facebook-has- been-intentionally-crashing-its-android-app-on-users/ • This was a “harmless” app people kept clicking, but what about that attachment sent via email? Fight Club, 1999
- 9. Malware – How Bad Is It Really? • There were on average 200,000+ new malware threats released into the internet each day in 2017, and that number generally grows each year (Panda Security, 2017). • Let’s do some math and round down. There are 24*60*60=86,400 seconds in each day… • 200,000 malware samples / 86,400 seconds each day = 2.315 malware samples / sec • You would have to analyze more than 2 malware per second, for every second in a day. • This assumes you never take a break to eat or sleep. • If I were a betting man, I would bet that these numbers are extremely conservative. • Simply put: Malware has gotten out of control. Jaws, 1975
- 10. So You Found Some Malware… • Four phases from least intrusive/difficult to most intrusive/difficult: 1. Intelligence Search 2. Static Analysis 3. Dynamic Analysis 4. Automated Analysis • What do you know so far? • File Type? • File Name? • File Size? • Cryptographic Hash? (MD5, SHA-1, SHA256) • Other file type specific info (imports & exports in a PE file, dig. sig., etc)
- 11. Intelligence Searching • Be lazy if you can, don’t reinvent the wheel. • Cryptographic hashes: • MD5 • SHA-1 • SHA256 • Literally, put these ^^^ values for the malware sample you want to learn about into Google! • Think about using the NIST NSRL. • https://www.nist.gov/software-quality-group/national-software-reference-library-nsrl • It is highly probable that any hash found in this list is going to be benign or close to. • Two examples coming up in screen grabs… Band of Brothers, 2001
- 13. “Sorta Free” Resources • https://www.virustotal.com • Malware scanning, Intelligence Feeds, etc. • https://www.virustotal.com/gui/file/795840d1cc2cea94379e41c60519a8e4439a817150d 8dc51b9f2ce8ea7a18d00/detection • https://www.hybrid-analysis.com/ • Similar to VT, above. “Hybrid Analysis” is their name, not necessarily the unbiased description. • https://www.hybrid- analysis.com/sample/dfcdcba97c46f24d4595d604959a0d762d1a58e2a5bc001daa44b2 ae3b650a94?environmentId=120
- 14. VirusTotal
- 16. Static Analysis • File Metadata • Cryptographic hashes • SHA256 • SSDeep - Similarity • File name • File size • File Format Specific Information • PE Files: Number of Sections, Name of Sections, Imports, Exports, etc • Disassembly
- 17. Static Analysis – PE Info https://cape.contextis.com/analysis/79752/
- 18. Static Analysis – Strings https://cape.contextis.com/analysis/79752/
- 19. Static Analysis – AV Info • Scan it! • Any combination of online services or AV software will allow you to scan suspicious binaries.
- 20. Static Analysis – Disassembly https://www.nsa.gov/resources/everyone/ghidra/
- 21. Static Analysis – Disassembly https://www.nsa.gov/resources/everyone/ghidra/
- 22. Static Analysis – Disassembly https://www.nsa.gov/resources/everyone/ghidra/
- 23. Static Analysis - Disassembly https://www.nsa.gov/resources/everyone/ghidra/
- 24. Static Analysis – Disassembly https://www.nsa.gov/resources/everyone/ghidra/
- 25. Dynamic Analysis DANGER! DANGER! DANGER! Archer TV Series, 2009-Present
- 26. Dynamic Analysis – API Calls
- 27. Windows API Calls • https://docs.microsoft.com/en-us/windows/desktop/api/fileapi/nf-fileapi- createfilea
- 28. Windows API Calls • https://undocumented.ntinternals.net/
- 29. Dynamic Analysis – Memory Dumps This can be used to unpack a malware payload, for example. https://cape.contextis.com/analysis/79752/
- 30. Dynamic Analysis – Debugging • WinDBG (Free-ish) • x64dbg (Free) • https://x64dbg.com/#start • GDB (Free) • IDA Pro (Not Free)
- 31. Automated Analysis • Cuckoo Sandbox • Great place to get your feet wet. • Tons of documentation online. • Can submit samples programmatically via the Cuckoo API. • Python • Shell script • Curl • Signatures can be developed to alert for certain criteria. • If you go this route, I highly recommend you run all network traffic through a dedicated “dirty network”. • Tor • PIA • Etc…
- 32. The Last Step? • Rinse and Repeat. • The information you learn in later steps can be plugged back into Google searches until you have learned as much as you can learn about your malware sample. • Go forth and start pwning malware! • Can your analysis scale to 100m samples? Omar from The Wire, HBO 2002-2008
- 33. Free Resources • Malware Unicorn Workshops • https://malwareunicorn.org/#/workshops • Ghidra • https://www.nsa.gov/resources/everyone/ghidra/ • https://github.com/NationalSecurityAgency/ghidra • Radare • https://rada.re/r/ • Capstone Engine • http://www.capstone-engine.org/
- 34. Free Resources (Continued…) • Unicorn Engine • http://www.unicorn-engine.org/ • Keystone Engine • http://www.keystone-engine.org/ • Cuckoo Sandbox • https://cuckoosandbox.org/ • https://malwr.com/ • Awesome Malware Analysis List • https://github.com/rshipp/awesome-malware-analysis • Python PEFile • https://github.com/erocarrera/pefile
- 35. “Not So Free” Resources • They are not free, but they are worth knowing about. Everyone in the malware and reverse engineering industry either knows about these tools or have used them. If you are looking for a job in the industry, you should be at least vaguely familiar with these tools and where to find more information. • IDA Pro • https://www.hex-rays.com/products/ida/ • Binary Ninja • https://binary.ninja/
- 36. ? Keith J. Jones, PhD keith.j.jones@ieee.org