>> If you were to look at some more malware,
there's plenty of websites where you can get it.
There's many websites like Contagio Malware Dump,
the blog where they will provide analysis.
They will say, "Hey, I saw this virus do this,
and it does this interesting thing."
You can download the malware and try to
find that stuff by yourself.
I like buyer's share.
If you really don't
like getting your stuff from other people,
you can always catch your own, make the honeypot.
There is plenty of software
out there that we'll cover later.
We can just next deploy,
and it'll just catch malware,
and you can analyze it.
Of course, you can always make your own malware.
There is plenty of builders out
there and there's source code out there.
A few notes for the paranoid people among you.
I will include the slide at the end of every lecture.
Some malware can execute
upon being scanned by antivirus products.
I've seen vulnerabilities and antivirus scanners.
They are not infallible.
I've seen malware that will
execute as soon as the icon is viewed,
like a Word icon or a PDF icon,
or even a system icon.
In fact, that's how as one to two others
that stuxnet had,
was that as soon as a file system
recognized the icon there,
it would automatically execute code,
which is pretty dangerous,
especially for a malware analyst
where we're just looking at that icon.
Now we didn't have an extension on it,
but we are still looking at it.
I've even seen where
extracting the file from the archive,
like we did, can execute the code.
That was a nasty zero day,
but know this stuff is out there,
not very common, but it
is out there, and you should be careful,
and we will learn how to deal with
malware in a more safe manner in the next video.
Then another note for those people who are paranoid,
MD5 is the industry standard right now,
but it can be manipulated.
Then there are MD5 hashes
out there for benign files like NIST,
the National Institute for Standards and Technology,
and I love them.
They keep a database of benign hashes,
of known good software hashes.
We're soon going to be looking at
the MD5s of those hashes.
They can make their malware
produce that hash where it is not
the exact replica of those bits.
It is a file of
their own creation and that's what we call a
hash collision and that's bad.
We should never have that,
but it is more common with MD5,
I don't think anyone has ever
successfully done it for SHA256.
The industry is moving towards
the SHA256 based identification,
but it's not there yet.
For those people who are paranoid about viewing icons,
we can work exclusively in
a command line only environment.
Just to show you that,
I'll show you here that we have sigma open,
and so everything we did,
we can do from a command line.
Sig drive, we can go to C drive,
we can go to users,
Sean, desktop,
to just autocomplete I just hit tab.
Now I'm in the desktop,
and here,
the first thing we did was we
looked at it in a hex editor,
so I'll do XXD,
then the filename, and then I will pipe it to less.
I can do just the top of the file.
Here we see DU.
There is the MZ header.
There's the DAS moves string,
there is the PE header.
You'll learn about that in the future,
but we now know what's an executable on EXE or DL file,
and we can even run a string on the bar up to left,
if you save strings,
go down to the bottom, you see some function names.
We know that it can create a file,
we know that is looking for
>> another module by file name,
>> we know it's important KERNEL32.dl,
which is pretty common.
We know those pops of job. We're done.
Bottom, we see the same strings we've seen before.
Padding, some strings,
Q to exit from less.
We also got the MD5 sum of the malware,
so we can go ahead and do that.
MD5, sum that,
so here's the MD5 hash that we had before,
where we can search bars total form.
This is all without looking at the icon.
If we just want to verify that it wasn't executable,
we can use the file command.
It will pull up, that is a PE executable for Windows,
using the GUI subsystem,
the graphics subsystem, like an exit.
Just to recap of what we've learned today,
we learned well for
the vernacular and terminology was for malware.
We learned about different malware types
and functionality and how they can easily overlap,
and when the overlap happens,
it's called the blended threat.
We did a one-minute triage with freely available tools.
I also showed how to do that from the command line.
I showed you where to get samples if you need them.
I'll also suggest at the end of every lecture,
get resources if you want to get more into this topic.
This is very bad,
but I highly suggest Practical Malware Analysis.
It's a big thick book,
but it is very good.
They have malware that they'll give you,
and they will tell
you to analyze it
based on whatever you learned in that chapter,
and at the back of the book,
they will show you their analysis which you should
have seen and what you
should make conclusion should have come to.
That has been extremely effective learning tool
for me and many other people.
Virus Research and Defense is
a classic book that's been around for a while.
It's a little dry to restrict through.
It's also big and thick.
But it's really more meant to be a reference.
But I know most people in my career field
and in your career field as well.
Pretty much all of them have Practical Malware
Analysis right there on their desk.
Thank you for watching the introduction
to the malware analysis on Cybrary.
We hope you've learned a lot and will continue
to watch our videos here. Have a nice day.