[Autogenerated] Mauer authors make use of an extensive set of techniques to
evade detection from security tools and hinder analysis.
And one of these techniques consists of using muller packers to encrypt
compress or simply change the format of the malware.
A packed executable Once executed it will unpack itself
in memory and continue the infection.
There are a couple of notable techniques of detecting packed malware so we'll
focus on the ones that can be automated easily with Python there are specific
signatures to detect the type of Packard that is used.
These are codified into your rules and at the end of this module I will
share with you the reference where you can get these rules.
So essentially by scanning suspicious falls with
tiara using these specific rules,
we are able to detect backed executable Another great technique is
detecting a low number of imported DLS and functions often times
while reviewing the imports directory,
you will find only functions that are used for unpacking and executing.
The code detection in this case is based on counting the
number of DLS and imported functions.
Lower numbers might indicate that we might be dealing with a
packed executable A portable executable file has dedicated
sections for the code but also to store data.
Once executed.
One of the anomalies consists of identifying sections marked,
read, write and execute essentially when a P file is executed.
An unpacking function will read and unpack the code,
it will write it back into these sections and execute it.
The detection technique is based on identifying sections marked,
read, write,
execute based on the characteristics field to get a
better understanding of of all sections,
let's consider the following example,
the portable executable Fall type contains a couple of sections.
The text section is used to store the code that is executed.
This is why it's marked read and execute a file can also
contain one or multiple data sections.
This can be marked as read only,
but also read and write and there can also be a resource section with
packed executable the story is quite different.
It contains a few sections and these are marked read,
write and execute essentially there is a small bit of code that reads and
compresses the code and then executes it for each section,
there is a characteristics field which essentially contains a set of flags.
These flags are codified into a value.
If the flag is set, the corresponding value will be one and zero.
Otherwise Let's consider the following example.
The text section has the characteristics field value of 1, 0, 1.
If you want to detect if the section is marked for read,
we can use the bit wise and operation with a mosque which is
a value that has one on the position corresponding to the
red flag and zero for the rest.
If the result from this operation is different than zero,
that means that the section has the red flag set.
If the result is zero, that means that the red flag is not set,
please take into consideration that this is just a simple
example for demonstration purposes.
In reality, the characteristics field is much larger.
I have included in here the correct information based
on the Microsoft documentation.
These values will be used as mosques to determine the flags for each section.