Hello and welcome back.
We are now going to do a practical hands on and analyze that sample one, please download this from
the recession and then zip it.
The password is cracking lessons, dot com.
I'll tell you, I find that you should get a food and safety is subfolder on 9/11 and this is the Navy
itself, so be careful of doing this inside your -- machine.
And at first glance, you will see that yourself fitting Ikon PDF icon.
And it also has an extension.
You can clearly see this because you have ANÍBAL, the short extensions by default.
Windows does not show the extension, so a casual user might be fooled into thinking that this PDF file.
Now we are going to do a static analysis.
We can use that to check the time.
So let's start with.
Ginette.
Do not rely on the extension.
So you still need to confirm that is equitable and Dana has found that there's a high likelihood 67
percent is HCFA.
So we know for sure is executable file.
Next thing we can do is use the studio to analyze the data so we can go to.
Utility Sholder.
And peace to you.
These to year, as I mentioned in previous lesson, specially designed for analysis, so the.
Now, going to hear give me time to analyze, and his analysis is, as you can see, as a weak position
for some of the views.
So this Tigran.
It has been increasing and he says you can go straight to the indicators and here it tells you the severity
level one, two and three level one is more severe.
So these are the indicators of compromise.
And you can see a number one level one would be the father things that his playlist.
The father of his black blacklist libraries.
The fine points in both states, minus the five exposes true stories Corvex.
And so on, so probably we stop to stop three, one, two, three are the main indicators of compromise
possibility only.
We cannot be sure until we go ahead and looking at the tools and then the fire currencies, things like
this, working with straight strings and take a look at the blackness.
So in the strings panel here, you can see the string tight as key and the size string and blackness.
Douglas.
So you can click on this to Tongo, show all the little ones first, and then you can see where the
strings that he has fun in this file, which is the.
Registry set value usually is used by malware for persistance to enable it to start to enable the operating
system to touch.
And you also have networking on circuit clozapine, you start out with some APIs use for connecting
to the network.
So bedfast, you know, have all this things, so this is definitely a no no.
And some more suspicious API calls Internet closed, Internet open and so on, Internet when you are
al.
Carlos, my name, so you can see on the black list that is marked in Red Cross.
And he also says he has got news, all the foreign operations here.
And he also has great process that he is able to respond additional processers.
This one crate to help snapshot in conjunction with the process to take.
I used to police the process is running on your belief system now.
PEPFAR has no business doing that.
So it's very highly suspicious that you find this kind of thing in this malware, in this program.
And that one is, shall I say, very highly suspicious, and you will see the dismal way to other programs.
And you see, it is also able to post something to the Internet.
And here you see the string, this is a sign of Hexa included 64 Hexa, including one of the ways in
which the program tries to obfuscate the strings.
OK, so that's the angle of the playlist, so we can see a lot of things here and just by looking at
this.
And then you can look at the important.
So this will give you even more.
And here you can see according to list, all right, so these are all the APIs that have fallen by these
to you and which has been released to.
Open process tokin.
Registry Sangalli is highly suspicious, that means he's able to create a registry keys, probably for
persistance purposes, as I mentioned earlier.
And this one is also highly suspicious, invisible, able to Internet open, Internet open, you are
in the news.
You can connect to the Internet, probably calling home, calling to a control and command server,
maybe to download additional bailouts.
And also, which I think most importantly, say, is used by America, who changed permission for memory,
and this is usually done when you want to hand back into certain that's of memory so that you can execute
it.
And also the default, which is used by now to give it a copy of yourself after you made a copy and
be somewhere else.
And as I mentioned earlier, to help in conjunction with process first process next year, issues to
list and enumerate all the processes which is running on your computer normally does that in order to
try to resist resist analysis.
He wants to know whether you're running Wireshark process explorer, excessive fatigue or any of the
reverse engineering and also Marineris tools.
That's why he's listing all the processes running on your computer.
All right, so we have seen quite a lot of suspicious things, indicators of compromise, as we like
to call them, are also known as IONSYS.
Now, the time stamp here, if you click on this, you will see that this memo was created on October
14 at 41 pm 1998, but this could be a fake year because this can be changed.
But it is a good indicator all the time when this thing was created.
And if you click on the light this year, you will see that many important functions, important functions.
This is the important.
Over here, and this is the least of the libraries where the imports came from, so you can see there
are a lot of imports for no reason to.
This is a library for networking, typically used primarily for connecting to the Internet and will
be used for registry, creating new keys in the registry going to be used by all these programs.
These are the two issues for creating a user interface.
So this shows that a large number of important functions.
So most probably this is not backed if that he will find very few functions, not so many like this.
All right, so just using these two tools alone, you can see quite a lot of things already.
So next thing you do is to go and get a hash so you can get a hash by using hash.
My file program.
Right.
Click on this and hash my file.
So now we've got a hash we can copy to modify and check various total.
So the hash is a showreel idea file.
The finding can be faked, so by the hash doesn't lie, so we head over to Vares total.
And they went to this open hill for the search function here and basically hash and hit enter and you
search the database and you find that fifty eight out of 71 hits.
So this confirms that it is a male.
So 50 years, only one antivirus has detected a smell in the past, so the hash, my father is definitely
a very good way to identify the adisa, the type of a class of the category of the virus in the elevator.
So you can see these are the variants through genuine Talita and so on.
And.
So this is very useful, some funds quite big, so you do and I've looked at Twitter so you can generate
a hash and search based on the hash and you can.
So even future, there are variations of any way you could also use the hash to identify using this
method which have shown you.
So these are three to someone who is using a lot of information into the family.
So whatever our is and so on.
So that's all for this interruption to static analysis as you in the next one.
Thank you, Heidi.