>> We're going to do another packing example.
We looked at the illusion bot strings
before and after packing.
[NOISE] We're going to look
>> at the antivirus detections,
>> and we're going to look at the bot's PE sections.
A good way to get a feel
for antivirus detections
>> is a site I've mentioned before,
>> called virustotal.com and it's
a meta antivirus scanning engine.
It has many different antivirus products
scanning a single file to see if any of them
trigger on that file and
>> that's useful for us, at least.
>> Copy, paste.
We can upload our original
botbinary.exe and someone in all likelihood has
already uploaded it in had
>> it analyzed and we can see it
>> was originally in 2007 and we can say reanalyze,
have it rescaned, but it doesn't really matter.
We can take a quick look
at pretty much everything has triggered off
of it except for the last few for whatever reason,
and they all classified as ST bot or
generic Trojan or IRC bot or whatever else.
It's known to be bad and people have even
said that it's really
bad and someone posted that
new texts that we saw in the last video,
and we can definitely see that it's a malicious file.
Now, what about the pact exe?
I haven't done this before,
so I don't know if someone's already
packed it and uploaded it and analyzed it,
but we'll see how many detections it's gotten.
It's also important to note that this is not
a good indicator of whether a file is truly malicious,
because a lot of these antivirus engines
are turned up pretty high in their
>> terms of sensitivity.
>> I'm not going to name the product,
but I've seen one antivirus company always alert
on my Metasploit executables,
even though in the real-world,
I've never seen
this antivirus software alert on anything before.
[LAUGHTER] They tend to tweak
their products to make it look
good in terms of detection.
Also, the deal that
VirusTotal makes with these companies is
that the antivirus companies will
scan a file and alert if they detect it as something.
It's almost a competitive
disadvantage because they are flagging
something that's malicious that
the other antivirus vendors may not know about.
The flip side of this is other antivirus vendors
know that this file is suddenly
malicious and they can mark it malicious as well.
But what came out recently,
we can see that a number of
products did not detect our packed file.
If we were a malicious actor, ideally,
this would be down to zero and a lot of packers on
the underground will advertise as fully undetectable,
which they call fud,
F-U-D, and it's not something they can guarantee.
But some packers are better than others
and since UPX has been around for so long,
either most consider it
malicious or most antivirus companies know how
to unpack it and scan its insides.
If we use another packer,
it might get even lower detection rates,
and if we use the packer on top of a packer,
it may even get lower rates.
But it did definitely take down our score
even though this binary,
this executable is a really old Trojan,
even though UPX is a really old packer,
it was still able to allude some antivirus engines.
As I was mentioning earlier what came
out in the news recently was that
some antivirus companies were purposely
marking benign files as malicious on
VirusTotal and
watching other antivirus companies just copy them.
It's, I don't know how to say,
poisoning the watering hole, if you will.
Here in our Kali machine, we have,
I just open two terminals here and I browse to
the malware analysts
>> cookbook code website, Google Code.
>> A lot of it is pretty old.
It's 2012 is when most of this was
released by [inaudible] several of
the scripts still useful and since they're open-source,
a lot of people have improved upon them
and made significant improvements.
But I just want to demo something here and that is,
we can download this script
>> and use it to take a look at
>> the sections of a PE file
pretty easily with the code they've released.
Typically, if I'm just downloading someone's script,
I'll take a quick look at it,
make sure it's not doing something obviously malicious,
but then I'll also make sure I
have the right dependencies.
I'll copy that and paste this,
make sure I can import all these
libraries, there's no issues.
Import this and there's no issues
because I already have the PE dependency.
But if you don't,
which most people don't by default,
you can do pip,
the most popular Python package installer,
install PE file and
it says it's already installed and I say, great.
I'm going to look for an executable on Kali,
an exe file of which there are plenty.
I'm just going to do a locate command.
Find would probably be faster but
locate is simpler to use, in my opinion.
We find plenty of very useful Windows executables like
the netcat version for Windows,
exe to bat, Windows Credential Editor
, so on and so forth.
I'm going to take one of these,
let's say wget, let's take netcat.
A lot of antivirus companies will alert on netcat
because it's pretty easy to just open up a port
and start listening or
make a pretty rudimentary backdoor.
I'm going to copy it to the desktop.
I just saved the PE scanner and I
just downloaded or copied over netcat
and I'm going to run
the script by typing in Python scanner.
Let's see, I can make it.
>> I'm going to specify and c.dxi.
>> This Python scanner or
the PE scanner will go through and say,
"Okay, what's this file? What's the MD5?
Sha-1? When was it compiled?"
It marks it as suspicious
because it's 1998 and
that's pretty old for an executable.
The CRC is off,
the code checking algorithm
or basic corruption checking,
not as good as a hash,
but it's just basic checking to see if
anything was corrupted wall on disk,
because hard drives use to
fail a lot more than they do now.
We can see the sections here and I want you to
take note of the virtual size versus the raw size.
The raw sizes, how big is it in the file.
This usually aligned to certain byte value and it
has pretty rounded up
numbers and we can see here that says,
"Okay, I need this much memory to
run this code in this section.
I need this much memory to access this," etc.
We can see the entropy values
are right here on the right.
It goes from one byte to another to
another to another to see how much difference
is between the bites since you
UPX has been around for so long and it
stands for the Universal Packer compressor I think.
It is also ported to Linux and
>> can pack ELF executables.
>> But more importantly, we can use
it to pack Windows executables as well on Linux.
I'm going to say upxnetcat.exe.
It opened up the netcat file,
compressed it, and then resaved it.
We also go a 50 percent compression rate.
Again, we shrunk the binary to half its size.
Let's run our little PE scanner script again.
>> We can see that again,
the hush has changed,
the size has changed,
the date stayed the same.
UPX was sure to preserve that.
Right here the EP,
the entry point has
changed and it goes into a weird section.
The script has marked that as suspicious.
CRC is again,
not correct and I think that's suspicious.
But more importantly, here
down where we can see
the virtual size versus the raw size,
the raw size is zero.
There's no code on disk.
There's no nothing on disk in the file.
But it's still requiring a lot of memory.
This is why it's considered suspicious.
Here, we can see
there's no real difference
between the raw size and virtual size,
but it has a very high entropy.
That is suspicious.
Here the virtual size and
the raw size are too big a
difference and the entropy is fairly low,
so this is not suspicious.
This is probably where some of our unpacking code is.
We can see that EP,
the entry point is at
UPX1 so it's going to
begin it's execution in this section.
Whereas before, it would have began
it's execution in the.text
section which is fairly common.
It's useful.
This is one of the first scripts that I run on
an executable just to get an idea of if it's packed,
especially if I don't see any strings right away.
Another tool that is very useful is PEiD.
PEiD is no longer developed or really maintained,
but it's free to download and use.
I'm going to invert this machine ready to be infected.
PEiD has a small database of packers.
There are people who have collected
very large databases of packer signatures.
Some false positives but overall,
it's a pretty good way to just get an idea
for whether a file is packed or not.
We have a fresh copy of our ready to be infected VM.
I'm going to drag and drop over Patty,
simple SSH client and
can actually do a lot more than that.
PEiD, which as I described earlier
is a bit old but still useful tool
and a lot of people still
have PEiD databases that
are fairly large and
have a lot of signatures for different Packers.
If we just drag and drop an executable like
Patty onto PEiD,
we can see that it's
using Win32 GUI subsystem compiled with
Microsoft Visual C++ and
has the entry point of the.text section.
We can actually look at
the other sections to see what's there.
The virtual size and
the raw size so it can visually
>> inspect where our script
>> was telling us and we can actually even have
a mini disassembler show us some interesting stuff.
Not as good as either, but still it's useful sometimes.
If we use UPX
to pack the file
on to the desktop and to upx.exe.Patty.exe,
now we have packed about 50 percent
again and if we execute Patty
>> it executes just the same.
>> It's unfolding in memory, is decompressing,
it's doing its thing and executing the original code.
That's very useful. Let's run PEiD again.
Nothing found. Scan it again.
But usually it will detect that,
that is UPX, but there's nothing detecting right now.
Probably because I haven't really
provided it with a good database.
The database is here. That's the reason
why is there's no user.db in database.
I'm just going to Google PEiD signatures.
There's quite a few of them out there.
I'm just going to go with a big one.
Contains characters in Unicode.
I hope they don't mess up the database.
But again, I'm just trying it.
Nothing found about the database is a bit messed
up because there were Unicode characters.
I'm going to do a save as.
I'm just going to transfer the file manually.
>> It's a bug.
>> I'm just going to replace it and rerun PEiD.
There's something wrong with that database.
I'm going to use a different database.
Apparently the other one from
[inaudible] isn't very good.
Not surprising.
Let's try it again.
Nothing found. It is not detecting UPX.
That is the first time I've ever seen that.
There's a signature for it,
4.6 and probably above.
It's looking for that and more signatures.
Let's see. What's the version of this UPX?
Version, 3.91.
Since UPX is open source,
a lot of people have taken
that source code and modified it more
to use in their own projects.
If we look at our just packed Patty,
there's no signatures in the database we grabbed
from the Internet for the newest version of Patty.
Although I expected there would be.
But if we grab UPX,
we can see that there is a signature for that because
the UPX program itself was packed with UPX 2.93.
Our signature database definitely is
working that we just grabbed off the Internet.
But it hasn't been updated for the newest version.
As we saw in our demonstration before packing,
we could see lots of strings in our illusion bot.
We could see that almost everything was
triggering off of some detections.
A lot of AV vendors were triggering off
of signatures that they
had made a long time ago for illusion bot,
had it's typical PE sections.
After packing, there were almost no strings.
There were fewer antivirus protections
and they had completely different sections.
I did a quick little thing showing you PEiD.
Almost every hour analyst has
PEiD and they keep their signatures updated.
I typically don't rely on such things.