Welcome back.
Introduction to static and dynamic analysis.
Malware analysis process, the malware analysis process can be generally divided into two main classes.
First, a static analysis and second, dynamic analysis.
The first step, of course, right prior to this is to obtain the middleweights.
And the last step will be to do the reporting after having done the analysis, so what is the difference
between static and dynamic analysis?
Static analysis is analyzing the malware, we thought executing it in dynamic analysis, we execute
email itself and then do the analysis.
What he stetting analysis, static analysis involves three things it could be, firstly, performing
a hedge by using tools to obtain a cryptographic.
Once we obtain a cryptographic, we can then hook up the Internet to see whether anybody else has already
done a similar analysis.
This is also how we can find out more information about any file, because as we have seen in the previous
lessons, you cannot rely on your file extension nor the file name in order to know what file it is.
So the only reliable way is to obtain the cryptographic, secondly, we can also analyze the embedded
streams.
So embarrassing is Unico strings, aski strings or even encrypted strings.
Oh, and codices.
And thirdly, we do analyze the behavior, a behavior will contain information, as you're seeing a
previous message.
So there's three ways of performing analysis will give us a clue as to what the file does, what, what,
what is contained within it.
And we can get an idea of what to look for when you later move on to the dynamic analysis.
So the static analysis tools are as follows, we have TriNet training will be used to identify the type.
You can also do the same thing using IACP for.
From here, we can know whether is on audio file of PDF File Zuffa or any other part, and then you
can go into using being text being text is used for searching for embedded streams.
The same is true for the strings strings.
Also a two hour command line two which can be used to look for Nettie's strings and then do useful.
He's ZOS, which is also allows us to search for those encrypted files, encrypted string files and
he can reverse the strings that I phone using Essabar.
He has got the SLR algorithm within.
The next one is quite small and B to you, these two are mainly used to examine behavior and you already
seen how to use them in previous methods and thus to hash my file as my father used to create the cryptography
hash for a particular file.
This is a screenshot of her and then it's a technicality session on a Tumblr trip to being used to identify
the photo, the file on the Alfaro, whatever it is, and before this can be used to identify with the
device being back or not.
For example, here you can see the fires impacting your pacemaker.
You can also give you information about the type of smell.
And then peace to you, peace to you, I can tell you why the suspicious episode is being used by the.
And other information as well, that being can be obtained from The Hague to be headed, so BTD is created
specifically for Annalise Millbrae and you can look for suspicious files, suspicious feels he's a PDA
and come here on the left, got them with me, CFF Explorer.
And we have seen this already in previous letters.
Next, we move on to dynamic analysis, dynamic analysis can be further subdivided in the two main categories
monitoring changes and also behavior monitoring in monitoring changes.
We will create a snapshot.
A snapshot of the operating system before running the farm, before writing the malware and in what
is already often a snapshot, we were.
Random, self executed and letting him run for a few seconds or a few minutes even so that the mother
will perform these changes to the police, reinecke new registry entry's creating new files, starting
new processes and so on.
Or even deleting files, so on.
And once it's finished, after doing that, he's going you give it a few minutes to do all these changes.
We will then take a second snapshot.
So now we can compare it to snapshots hanging from the comparison.
We will know what the changes mean by the movie.
So that's how we know better.
The malware has created a new registry key.
And I mean, you pretend you files next.
His behavior monitoring, behavior monitoring is where we will study in more detail the behavior of
the running malware.
For example, we can see if the malware has created any new processes.
And with a script written, new fire the Detainee Files.
And so on.
So those are the two main categories of dynamic analysis, dynamic analysis to some of the common tools
used for dynamic analysis, shot that can be used to create a snapshot of the operating system before
and where they run.
And then after running a mile, they can take a second snapshot and then do a comparison of the two
snapshots and will tell you which the changes are, the changes that the military has made to the operating
system.
From there, you can know if the weather has created any new keys in your registry.
And we can also know what new files which the mother has created.
And also other changes, next Tuesday's hotel runs now auto runs will be able to tell you what are the
persistance mechanism which the public has used.
Now, it is typical for a member to try to survive a reboot of the operating system by creating new
registry entries inside the inside the registry hall, creating copies of each cell in setting for the
locations which you are to start any programs contained within it.
So I try to show you all those things.
I think pregnant is used to capture any kind of any kind of network connection to any outside service.
So they know pretend to do so, which is they tried to reach.
And this is how we know what the name of the service, the You Are House and so on.
We finished with the email was trying to connect to so will not allow the of actually connected to the
Internet because we never intersect those packets and fake her reply.
And then they receive a call, a peak at fire, which contains only the connectivity connections which
we can analyze using another tool called Wireshark.
So it's very powerful, you can open the peak far from Vietnam and you can analyze all the packets in
detail, then you come to Propman, also known as process.
Moneta from one can be used to analyze the API, which a malware course and is very useful and analyze
the various writing in the file, creating files, creating a registry, keys and files and so on.
And then we can save this from session her see as we file and then you can use an error to construct,
not to open it.
Problem on CSP for a raw, beautiful graph, a visualization graph which can then show us things which
we are likely to miss if you're just using the text output from Popline.
So you can see what the files which has been renamed, where the malware has created a copy of 70 Niemi.
We can also see why the registry, which are created in order to maintain persistence of the malware.
And also we show you the various threats that are created by the malware.
So product is very useful for that and the other things as well.
For example, reverse engineering, where we try to disassemble and the cell to study the code and its
assembly hall, even a different barcode, and that attending will be more only memory analysis.
Now, even though the some some malware may be packed to in order to resist the analysis by any malware
that is bad, we need to unpack serving the memory and Hasmet memory that he says can be used to defeat
the party.
And finally, this automation we use of automation tools to perform the SO.
Now, the goals of all this analysis is to find out what system modifications being made by the malware,
why the registry modifications, what Neville traffic is being generated, doesn't call home to download
additional package and any tools.
And how does the how to.
And then finally launch any other processes, so this has some of the questions who you are looking
for when you're performing their duties, so we don't need you to end this lecture here.
Thank you.
Watching.
I'll see you in the next on.