#advanced static analysis

[aninsecureworld]

Advanced Static Analysis #3

The third part of the Lab from Chapter 5

15. At 0x10001701 is a call to socket. What are the three parameters?

I jumped to the wrong section 10001071... and spent an hour analyzing something difficult. 

16. Using the MSDN page for socket and the named symbolic constants functionality in IDA Pro, can you make the parameters more meaningful?What are the parameters after you apply changes? 

I’m going to have to add a plugin for this exercise. I think I’ll need IDA Pro as well. The answer was:  These arguments correspond to three symbolic constants: IPPROTO_TCP, SOCK_STREAM, and AF_INET.

17. Search for usage of the in instruction (opcode 0xED). This instruction is used with a magic string VMXh to perform VMware detection. Is that in use in this malware? Using the cross-references to the function that executes the in instruction, is there further evidence of VMware detection?

Had to search for a sequence of bits: “ED”

Using cross reference on the function that called in. We can see the virtual machine check happens again. If the malware finds it is in a VM. Then it will stop installing.

18. Jump your cursor to 0x1001D988. What do you find? 

Doesn’t seem to mean much. It’s just random data.

19. If you have the IDA Python plug-in installed (included with the commercial version of IDA Pro), run Lab05-01.py, an IDA Pro Python script provided with the malware for this book. (Make sure the cursor is at 0x1001D988.) What happens after you run the script? 

20. H With the cursor in the same location, how do you turn this data into a single ASCII string? 

21. Open the script with a text editor. How does it work?

I don’t think plugins work with IDA Freeware. I might have to let these excerises go. I’ve read up on what each of the questions lead to. Seem to be focused on using features, by pressing a key, from the plugin. I’ll try to get IDA Pro soon. I want to play around with it more. 

Reflections

Finally! I’ve completed the IDA Pro exercises. The final 7 questions seemed to be focused on using plugins which was unfortunate since I’m using the freeware.  It was tedious at times .Grinding through functions and assembly trying to work out what’s going on. The work seemed to have paid off as I feel I’ve gotten more familiar with the assortment of tools offered by IDA. I’ll try to get my hands on IDA Pro in the future.

[aninsecureworld]

Advanced Static Analysis #1

There’s a single Lab for the chapter on IDA Pro that contains 21 questions. I’ll be breaking those questions into separate blogs. The questions aid a beginner in analyzing their first IDA malware. 

1. What is the address of Dllmain? 

IDA Pro shows the Dllmain’s location at 0x1000D02E.

2. Use the imports window to browse to the gethostbyname. Where is the import located?

It’s in .idata:100163CC. 

3. How many functions call gethostbyname? 

By highlighting the name and then using xreference we can determine that it’s called 9 more times. However, once we check the address its by 5 functions. All 5 function were written by the malware creator/s. 

4. Focusing on the call to gethostbyname located at 0x10001757, can you figure out which DNS request will be made? 

From this snippet of assembly, string at off_10019040 is moved into the EAX registers then it’s pushed for the call function. Hovering over off_10019040 reveals  “[This.is RDO]pics.practicalmalware.analysis”! 

5. How many local variables has IDA Pro recognized for the subroutine at 0x10001656?

I jumped to the subroutine. We only count the variables with negative offsets and I get 20 variables

6. How many parameters has IDA recognized for the subroutine at q5?

Just one as seen from the image above.

7. Use the Strings window to locate the string \cmd.exe /c in the disassembly. Where is it located? 

It’s located at 0x10095B34.

Reflections 

A set of good exercises to practice navigating through IDA Pro. Hopefully the next few questions will become more difficult! I want to work out a few functions.