Hello and welcome back.
In this video, we are going to do beheader and hash analysis so the satta open flame activities and
run the piece to program.
We are now in the unpacked version in the studio and we try to analyze while is analyzing, you can
see read messages in some of the films.
Now that he has finished analysis, that is going to take a look at some of the indicators of compromise
and you see how many like a one.
First session is right about.
And they hear five references, three states, Blankley's 25 playlist strings, and so now so far this
year.
A virus totally isolated, it is nowhere.
And yes, I'm fine, but away at one like it.
And also the fire continues.
A vegetable executable sections one ton of debt.
And they also has some modify executable sessions one day and file contains results in a language that
is tagged as Russian language.
So we take a look at all these now in one by one, starting the is often a hater.
So and often hey, there you see the subsystem is a GUI.
Therefore he can run, he can integrate with GUI system and that is how this is.
We saw some JavaScript code to show a fake thing, warning about your system being infected with spyware
in any way.
Now, under the father here, you can see the compilers time this program was compiled on May seven
in the year two zero zero seven.
And if you go to the resource section and hear dialogue, you can see the language is Russian.
So another indication it could be Russian origin.
And if you go to the.
Sessions here, you can see, yeah, the tax section, which is supposed to be taking it, is writable
now that is a red flag because causation is supposed to be executable and readable, not writable,
and it's also self modifying.
So this could be indication that he could be performing some modification as it is running.
And then the libraries, you see the table.
So this looks quite normal.
A lot of this is because you've unpacked we have unpacked it for the population.
If you were to analyze the patient, you find find a lot of the health impacts are not on there.
So very few functions important in your case that it is by far the urgent package.
So we see all this quite a number of patients.
There's nobody but so less listed according to the list.
And here we find registry set value, indication of resistance.
Malware is trying to process itself to making a registry, using this API to create a new.
And we also see he's able it is able to connect to the Internet, WASC Stathakis initialization function
for windsock and here is also the Windows networking functions being used to perform actions to get
things ready for connecting to the Internet.
He can also execute other programs we need to put API for executing how the processes.
OK, so now let's take a look at a so these are quite a number of indicators of compromise and now let's
do a hair analysis.
So you first start off the question correctly, and then here we hash my files and you can copy the
ME five here and open the various totalling crome and see the various photos report.
Click on the search deck and Paisios modify it into.
You see 60 or 70 one, and the averages have detected the type of virus it is.
Jorgen.
Troy Harris is on.
So this confirms that this is a virus.
So that concludes our static analysis for this Noé sample to thank you for watching.
I'll see you next time.