>> Like I said before, we're
going to go through a few basic tools
and just a very basic one-minute three-hour situation.
I'm just going to say, SysInternals by
Mark Russinovich is really good.
The Map Pack, the malware analysis pack
by David Zimmer is really good.
I would highly suggest you get
a text editor like 010 is really good.
There are free ones out there.
A PE viewer,
a lot of these are free.
I would suggest one of those,
but we're not going to show them here.
A disassembler, IDA Pro is the industry standard,
but there are some others there that are pretty decent.
Hoppers from ACT, x64_debug does a pretty good job at
debugging or does a pretty good job
at disassembling 64-bit code.
But it is the debugger,
so it will start automatically
executing code if you're not careful.
Just as a personal preference,
I would prefer Cygwin,
this is a Linux environment
because it has with it MD5sums,
you can calculate hashes.
GCC is a GNU C compiler that can be used to
create executable code that from C code,
from the command line right there quite easily.
If you don't want to install Visual Studio,
xxd is a hex viewer,
much like 010.
But command line-based,
the file command, the strings command,
and Cygwin also have this on Python
2.7 and 3.3 distributions inside of it.
Nifty, if you just want to have an all in
one package for a bunch of different tools.
Notepad++ is a text editor I highly suggest and 7zip is
a compression and decompression tool
that I highly suggest.
I'm going to say you were presented with a sample,
what do you do?
Let's say these are the tools I just adjusted.
>> Malware analysis pack,
>> you just run and it'll install several
of these shell extensions, not that.
It will also install some of these shell extensions
such as MD5 hash and string submit virus total,
010 and then install this shell extension.
7zip here, install this shell extension,
which is really nifty because you can
easily just extract lots of different file types.
This is an MSI file type,
so I can probably extract that.
If I look over here on my desktop,
I'll find that it was extracted.
Then if I open that,
I can see that there's lots
of files in that MSI installer.
Then I can further dive into
this EXE file and say I would like to
extract that and cue it
inside the EXE file with all the different sections,
the dot text section is famous for having
executable code and not actual text
for some weird reason.
Inside the resource section,
I can find a text file.
Sometimes malware keeps
other malware or other components,
other executables in their resource sections.
Here's pretty benign, it's just a text file.
But when you're setting up Cygwin,
it's important to note that some tools aren't
installed by default and
here I'm just going to run through the basic.
If you're installing this software the
first time and this scares you,
don't let it scare you,
all the packages should be signed and verified,
so I usually pick just any old thing.
You'd like to stick to edu or government websites.
To get one command that I really like called Bile,
I will have to type in binutils.
You go to development and it's
this first one here, binutils.
I've already installed it,
but you should click this to make sure it installs.
Another one is xxd under editors.
Last one is files.
I'm pretty sure it is default.
No, the last one is gcc.
You don't have to install it if you don't want to.
I prefer to keep it around,
give it just, like I said,
if you to pump some C code up.
Let's say you get a sample here,
you don't know what it is.
Some instant response guy said he just found it,
okay, that's bad.
Let's say I just
try looking at it
in a hex editor just to see what's there.
On the left-hand side, here's
the raw binary data represented in hexadecimal format.
I'm going to write on the left-hand side,
it shows the raw hexadecimal format
and on the right-hand side,
it shows the ASCII representation of the binary data.
Obviously, the binary data is a lot of
gibberish if you tried to view it as English text.
But a lot of programmers have a lot of
embedded ASCII like Mz.
This file header,
you know this is an executable or
Windows executable due to this file header.
This string is more proof that it has
a DOS file header and this is what we call PE header,
we are going to learn a lot more about PE files in
the future but not right now,
you just know that this is
an EXE file or a DLL file at this point.
Let's say I want to get hash,
it has an icon right here.
I can copy the hash and search Google for it.
One result pops up,
it's for a virus total.
For those of you who don't know virus total,
it's a website where you can submit any file
and it will scan it with about 52,
it goes up and down sometimes,
with 52 at this point in time,
antivirus products and it
will tell you the detection's between them.
This should not be used as
>> an end-all be-all in security.
>> But it is useful.
We see the first analysis in 2014,
in May it was uploaded by this name.
This is a SHA256 hash.
You've all this information saying, "Okay.
There's one person who commented,
said it was bad,
I had 42 detections."
A lot of them say Symmi, Zbot,
Zbot, and Zbot, and Zbot.
If I Googled Zbot,
that might lead to some more information;
Zeus malware, Trojan.zbot, trojan.zbot.
It's good stuff in the comments.
Someone has commented, malware family
Zeus, version 2.1.0.1.
Some other information, which is pretty cool.
I have pretty much
confirmed this is Zbot, this malware example.
It's important to know
that why I have shown you a few tools,
your analysis should drive the tools.
Your tools should not drive your analysis.
Now, let that sink in for a moment.
Your tools should not drive the analysis.
You should not say, "Oh,
I have this or this tool,
let me run this script or
let me upload to virustotal every single time.
Because I've seen some stuff on
virustotal that probably shouldn't have been
uploaded like sensitive company emails
or internal memos or classified things,
things that should not be up there,
but people are just like, "Oh,
let me just upload everything because virustotal told
me that the virus is not very good."
If I want to see if
there's any strings in the malware,
I can with this,
with the malware analysis pack tool.
I can see that there's a lot of gibberish.
This stuff looks interesting.
In a way, I can Google for this type of
stuff to do like an RP page.
This looks like a PDF document type of stuff,
so maybe this thing drops
a PDF after it's done executing,
it will display a PDF file
so that it doesn't look as suspicious.