Hello and welcome back.
Now we are going to perform embedded string's analysis.
To start all the open utilities and used to being taxed.
Winter is already on the desktop, so we can do stumblingly.
So we use the and PANKRATION.
And running in case.
The first thing we see is the energy, Heda, this program cannot be running dustmen confirming that
this is a biffa.
Scroll down and see any other interesting things, you also see that this is a macro with C++ runtime.
Program.
We see some registry strings here, so probably this is for persistence, especially on registry set
value.
And we see something interesting here.
From here to here, seems like e-mail quote, and you can see there some JavaScript involved as well,
and here seems like some kind of message is going to show the user your computer is in danger.
Do the security center has detected malware, spyware.
Infection, it is strongly recommended to use special anti spyware to to prevent the attackers, so
it is trying to he's giving a fake error message.
And then here there seems to be a kind of request to download something from this site.
Downloader recently, Volcom from the new movie, probably trying to fool the user to download a fake
antivirus after scaring the user with a false message, and you can see he is trying to download something.
And this is a Web site.
And then down here, we see some kind of registry.
Indebting.
She also seems to be a string indicating some file like extension, which brings to mind probably a
fake license file see cogie license.
And here is probably the way that Melva is trying to create persistance so that he can start again when
they use a lot of logging or reboost computer.
And here we see the name of a file XP update.
Nastasi, this could be the default drop by the malware and this probably is her father.
This Uranga is going to run.
So we can confirm that in that analysis later.
But good to know what they look for.
So we can probably make a note here on the fast and we have seen.
So EXPE Abdi, he said, failed to account for.
In the location seems to be protected, but see windows and normally no like in your right to see windows
with elevated privileges, so maybe run this malware later in a dynamic analysis.
We might need to run it as administrator so that he can perform the dropping of this fire in this location.
OK, so that's it for the analysis.
Now let's see if there are any encrypted strings to Centrelink of Australia, you can use his all such.
So it's social research for any street and brute force to try to decrypt.
So is also searches.
Is this how you run your search?
If you run into any parameters, he will show to help help.
And then to his answer, which you can do like this, the name of the impact file and then some silly
string that you are looking for, for probably EDP.
So the first parameter is the name of the number in this case where the activation second parameter
is the string you are looking for.
So you would say for this string and then you will brute force some of the encryption keys to see if
they can find a string containing EDP.
So let's press enter.
And you see some hit and first line shows he has found using the encryption key of zero zero has found
the string.
So encryption gives you zero means there is no encryption.
So we can ignore this on.
Anguishing 20 minutes, is this a conversion from locatable case so we can also, you know, this hasn't
seemed to be any encrypted any of strings in this containing his TDP.
You can try this used to search for this because sometimes we packed some files, encrypted files containing
certain B B files.
And if you are looking for this and you know that this is part of the string in Apiata saying this program
cannot be running Darusman.
So that's why we are trying to search for this.
String this to see whether the encrypted strings containing this.
So Presenta.
And so far, we only found one hit, but this one is encryption key zero zero, that means this is this
is not encrypted at all.
So this is also not encrypted, encrypted strings.
So it seems from the last search and the two most common things that are going to search for history,
and this doesn't seem to have any encrypted strings and very sorry.
So that concludes the embedded strings analysis.
I'll see you in the next one to continue with the rest of the static analysis.
Thank you for watching.