Welcome to the new "Introduction to Malware Analysis" series. In this premiere episode, we're going to look at an unpacked and packed version of a very basic Windows binary. We'll ...compare the two files in IDA and note the major differences. Then, pretending the packed binary is malware, we'll perform dynamic analysis on the file using x64dbg, with the goal of allowing the code to execute until the binary unpacks itself in memory. Once unpacked, we'll explore how we can dump that binary to disk for further analysis.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
IDA Freeware:
https://www.hex-rays.com/products/ida/support/download_freeware.shtml
x64dbg:
https://x64dbg.com/#start
CFF Explorer:
http://www.ntcore.com/exsuite.php
UPX:
https://upx.github.io/
INetSim:
http://www.inetsim.org/index.html
Background Music Courtesy of Modern Vintage Gamer:
https://www.youtube.com/modernvintagegamer
Welcome to the new "Introduction to Malware Analysis" series. In this...
Welcome to the new "Introduction to Malware Analysis" series. In this premiere episode, we're going to look at an unpacked and packed version of a very basic Windows binary. We'll ...compare the two files in IDA and note the major differences. Then, pretending the packed binary is malware, we'll perform dynamic analysis on the file using x64dbg, with the goal of allowing the code to execute until the binary unpacks itself in memory. Once unpacked, we'll explore how we can dump that binary to disk for further analysis.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
IDA Freeware:
https://www.hex-rays.com/products/ida/support/download_freeware.shtml
x64dbg:
https://x64dbg.com/#start
CFF Explorer:
http://www.ntcore.com/exsuite.php
UPX:
https://upx.github.io/
INetSim:
http://www.inetsim.org/index.html
Background Music Courtesy of Modern Vintage Gamer:
https://www.youtube.com/modernvintagegamer
As a continuation of the "Introduction to Malware Analysis" series,...
As a continuation of the "Introduction to Malware Analysis" series, this episode walks through an analysis of a potentially malicious PDF file. We’ll look at three (3) tools from Didier ...Stevens: pdfid.py, pdf-parser.py, and oledump.py. Using these tools, we’ll extract an embedded Microsoft Word document from the PDF, and then extract an embedded VBA macro from within the Word document.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
Didier Stevens - PDF with Embedded DOC Test File:
https://blog.didierstevens.com/2015/08/28/test-file-pdf-with-embedded-doc-dropping-eicar/
Didier Stevens - PDF Tools:
https://blog.didierstevens.com/programs/pdf-tools/
As a continuation of the "Introduction to Malware Analysis" series,...
As a continuation of the "Introduction to Malware Analysis" series, this episode covers another tool that will help us extract embedded content from within a PDF. We’ll first run the ...tool against evil.pdf from the last episode, and we’ll find that it can easily extract the embedded Word document that we were able to manually extract using pdf-parser. Then, we’ll run the tool against another sample PDF that contains embedded images. You may be surprised by the results.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
Origami PDF Framework:
https://github.com/gdelugre/origami
Didier Stevens - PDF with Embedded DOC Test File:
https://blog.didierstevens.com/2015/08/28/test-file-pdf-with-embedded-doc-dropping-eicar/
As a continuation of the "Introduction to Malware Analysis" series,...
As a continuation of the "Introduction to Malware Analysis" series, this episode covers an awesome utility called ProcDOT. As you are likely aware, Sysinternals’ Process Monitor, also known as Procmon, ...in combination with PCAP data provides a treasure trove of information that is commonly used in behavioral malware analysis. The problem is, data from those sources is disparate, and typically manual analysis is required to correlate process-related information from Procmon with the corresponding network-related activity derived from the packet captures. What if there was a utility that did that for us, AND presented the results in an interactive, visual format? Enter ProcDOT.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
As a continuation of the "Introduction to Malware Analysis" series,...
As a continuation of the "Introduction to Malware Analysis" series, this episode covers a powerful tool called YARA. Borrowing from Wikipedia’s description, this tool “provides a rule-based approach to create ...descriptions of malware families based on textual or binary patterns.” Using a simple command, we can direct YARA to use a set of logic to search for strings and sets of conditions across any arbitrary data. So, imagine you suspect a particular piece of malware has infected a system and you want to quickly look for those IOCs to verify your suspicions. How would you accomplish that? Would you recursively grep every file on disk looking for a particular string? What if the string were represented in hex or binary? What if you needed to do this on a large number of endpoints running a variety of operating systems including Windows, macOS, and Linux? Well, that’s exactly where YARA can help.
We’ll first review the anatomy of a YARA rule, then we’ll practice using the tool, and lastly, we’ll take a look at how we can leverage the power of YARA within memory forensics.
*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***
YARA:
https://virustotal.github.io/yara/
YARA Rules:
https://github.com/Yara-Rules/rules
Background Music Courtesy of Anders Enger Jensen:
https://www.youtube.com/user/HariboOSX
