Hello and welcome back.
This is our fifth now their sample, which is simple Trojan.
The learning objectives, analysis of the Trojan file ID.
Identifying custom Bekker PPE, do you?
Identifying abnormal function epilog.
Using Ghidorah and ex DPG to analyze abnormal epilogues.
Unpacking and dumping and that it could and this will be an alternative to the ritual ELAC method,
which we have studied in the previous sessions,
a normal function will have following prolonged and the following epilog.
He will have pushed EVP in the Paula.
Followed by a movie, E.S.P.
This will be followed by multiple lines in the function body.
And ends, we have a function epilogue which looks like this, a GBP followed by Haret.
So every function will be having this function Poola and function epilog.
So this is what we call a normal function.
In Melee.
We can find sometimes abnormal function epilogues.
Unpacking is often the one way.
We will look for the abnormal transfer control.
This court would like a standard epilog.
There will be a jam instead of rent, sometimes a push rent and other divisions.
And these often happen at the end of her function, so we shouldn't get caught up in all the details
in the body of information.
Fake returns.
This is an example of abnormal function epilog, sometimes we will see a push which pushes an address
to the Steck.
Following that, there will be a routine instruction.
Normally, we won't find a pushchairs before that, we were supposed to have a pop before.
However, in this a.m..
Malware could sometimes you see a push before it and the red will return the whatever address is on
the stack.
So this threat has no intention of returning to the color of dysfunction.
Instead, the red is a mechanism to jump straight to the address in the stack.
Why isn't this tech?
And what is on top of the stack is the embedded Koeser, which contains malicious instructions.
So this is a one way, one way, because the rent has no intention of going back to the collar of this
function.
That is why we say it is one we.
Unexpected jumps, sometimes we will have some pushes and then followed by jump straight to the red
Y because the rain will have contained the address of the embedded instructions for malicious code.
So the jam will come unexpectedly straight to the red.
So they will now come straight to the embedded code referred to by the Congress and the top of the stack.
So this is called unexpected jumps.
Sometimes malware will use shortcuts to try to make it difficult for the analysts now what a shortcut
historically shortcuts a machine called the response a common shell, for example, ACMD or a BATIA.
And sharks are typically injected into vulnerable programs, for example, in the buffer overflow exploit,
the return address is always written to point to a new address containing a shark.
If sharks are used in Yerbury, yeah, nowness exploits because they are typically exploiting the vulnerable
program in malware.
However, Shelke can do anything, not necessarily spawning a common shell.
For example, you can unpack malicious instructions or fake returns or unexpected chum's, and you can
refer here for more information about how to write shell codes and what shortcuts.
This is an example of a complex malware which contains unpacking techniques, for example.
The malware in the epilogue is my push and address to the stack, and that will be followed by written.
So the return would then jump to the address on his stack and go to the Chalco in memory and the Chalco
in memory.
We'll continue in a normal, happy life itself, whereby you find a Bush address to the state followed
by an abnormal return, and this return will return to the address on a stack of the Chalco, and that
address will be address containing the embedded malicious code.
So this is like a two layer unpacking mechanism.
So in the next lesson, we are going to start to analyze Melody known as the second Trojan, which makes
use of these two layer unpacking mechanism.
Thank you for watching.
I'll see you in the next one.