Hello and welcome back in this session.
We are going to do for analysis as well as particular detection.
So in a previous session, I already provided this file for you to download from the resource section.
So, yes, and by zip it, the password is cracking lessons dot com.
And then open the door for the.
And this is real life where in some way, Tesler great grandson way.
So now we are going to analyze it, the TriNet to see the type.
And if our time is SCADA, so is a Windows executive.
Next, we will then look at.
Try to detect if any peckers, so you go to their utilities and you open the i.e. detected easy.
We didn't detect it easy to open our mailbag.
They did not detect any Pécas, but that doesn't mean they're not, because the other thing is essentially.
You can click and he tells you that it is back then, if I may say.
So it is seven point six entropy, entropy, the measurement of how uniformly the bits distributed across
the fall.
So if the entropy is uniform and a random really randomly distributed, it is not Nigera.
It means that it is encrypted, encrypted or encoded for normal files will not be so random as to the
distribution of the bits.
So that is the meaning of entropy.
The maximum entropy, eight point zero.
Anything above seven is usually packed normal and backfills.
We have the entropy of around five to six or maybe slightly higher than that.
So as you can see, even though the pack is not detected yet, entropy is very high, seven point six
percent.
Then next thing you do is you can use EIC hemophobia.
To analyze this, fine.
And he says on the AC and he also failed to detect the any device, any PECC.
So I was hoping that it spent came from ease's entropy, high entropy.
All right.
Next thing we do is analyze this, file the piece to you.
So in these to you, it's open, it now appears to you and me already analyzed the file first and click
on the main main file here and then here you will see the signature is not available.
He doesn't know what, what and what file it home is packed.
And then you can see the description is known at.
For five years executable.
So let's wait for it to complete the analysis, as you can see, waiting here.
Now, the analysis has completed and we can go and see the libraries there are for libraries, but very
few inputs, which is unnatural.
We go to the FBI.
The e-mail address table and you can see only one, two, three, four, five, six epis a normal program.
We'll have more on this, much more on this maybe 60, 800 FBI.
But you don't have to go to CPI's.
They came from these libraries.
So this is a definite indication that it is back.
Next, you can go and look at the.
Seconds.
And here you can see very suspicious looking satiates Bahra.
CRT lock.
And then he look at the sections here along the entropy is very high, seven point six CRT entropy is
also very high, seven point eighty three.
So another indication suggesting that is back.
Take a look at these strings and who here you can see.
Some of the.
API is mentioned in the stream.
Scroll down and see what else you have.
OK, not much, you can see most of the strings are correct, this is another indication that it is
probably like.
So from here, you can more or less conclude that we have very high probability that this malware is
spent so that you stop is a session video here and we can now know what to do.
The next step will be for us to try to unpack this malware.
Since it is a custom PECC, we cannot use any of variable, any of the available and ready made and
PECC that are available from the Internet.
So we have to unpack it manually.
So for that, I'll see you in the next three years.
Thank you for watching.