Hello everyone. 1
Welcome to another video of malware analysis and reverse engineering course. 2
Starting from this particular video we are now going to focus on portable executable file formats which 3
are basically executable files for Windows operating system. 4
So if you remember in our previous videos we primarily focused on understanding th cyber kill chain. 5
To really understand how a cybercrime operation works in the digital space. 6
After that, we looked at some of the common delivery mechanisms by which malware or weaponized files 7
can be delivered onto your system. 8
We looked at things like analyzing spear phishing e-mails looking at e-mail headers and stuff like that. 9
After that we looked at e-mails attachments which consisted of things like document files or PDF files. 10
We then looked at the structure of these document files to really understand how we can analyze whether 11
there is something suspicious or bad inside the file. 12
Now what happens is we all know that spear phishing is one of the most common ways of delivering malware 13
onto your system. 14
Now usually those spear phishing e-mails would either have a document file as an attachment or it may 15
contain a hyperlink which when you click would redirect you to probably some website where a document 16
is posted and from there it will just try and download the document and execute it on your machine. 17
So document files basically serve as a first level payload or the entry point onto the system. Those document 18
files would not be the actual malware that could infect your machine. 19
They will be the first level payload which will serve as the delivery mechanism for this second stage payload. 20
The second stage payload is the actual malware. 21
It's actually an executable file a binary file which will run on your Windows operating systems. 22
Just to give you an example. 23
There is a difference between how you install a software and how you modify a document onto a machine 24
right. 25
In case of document modification you load a document in a secondary software and you edit the document 26
you save it and that's it. 27
That as in case of a software you actually install it on your machine because it requires certain special 28
rights before it can run on your machine. 29
That's the reason why documents can only serve as a delivery mechanism. A weaponized document can help 30
deliver an executable malware onto the machine but unless the set executable doesn't land onto a machine 31
Your machine is still not completely infected. So that's why analyzing portable executable files is the 32
most crucial part of malware analysis. 33
So the processes and steps that we learned in previous videos was more like a stepping 34
stone. I do not want to directly to analyze executable files 35
I want you guys to really understand the flow as to how an attack happens and in that way, you can effectively 36
respond to threats. 37
So moving forward we are primarily going to focus on executable files especially on Windows machines 38
so the PE file format or Portable Executable file format. 39
What exactly is a PE file. Portable executable files are nothing but a data structure format for executables, 40
object codes and DLL's in Windows operating systems. 41
It can work for both 64 as well as 32 bits. 42
So every executable that exist on the windows file is a portable executable file. 43
It has to be in that structure so that Windows can really understand that. 44
OK. 45
It's in a critical executable file that should run it. 46
Let's load it into the memory. 47
Link It's different drivers or linkage with different required DLL's and start executing it to really 48
see what the executable is doing on the machine. 49
So all the software everything that you install on your Windows machine is nothing but a portable 50
executable file. 51
DLL's are also of portable executable file format because DLL's are also a kind of executables. 52
So DLL basically stands for dynamic link libraries. 53
They are nothing but reusable codes that are present in the Windows environment which you can 54
you can use if you want to create softwares on the windows operating systems. 55
So a p e file consists of a number of headers and sections that tells the windows dynamic linker about 56
how to map that file into the memory. 57
So what happens is when you run a portable executable file it's actually on the disk. 58
So before it can be executed it has to be mapped into the memory. So the PE file structure tells the Windows 59
operating system about how to map that file on disk into the memory and how to locate all the different 60
resources are all the different DLL's that the portable executable file needs. 61
It's a data structure that tells Windows OS loader which information it's required in order to manage 62
to grab executable code. 63
It includes dynamic library references for linking API export and import tables. 64
That's very critical information and we'll be looking at actual examples in. 65
In this particular video or in the next video going forward. 66
The PE data structure includes things like DOS header, DOS stub, PE file headers, Optional headers & bunch 67
of sections and so on. 68
Let's quickly look at an example. 69
So this is a very simplified presentation of the e files structure. 70
This is how different sections of the file would look like. 71
This is a very simplified version so it starts with a DOS header. 72
Then it has PE signature or PE header. Then it has the COFF header or the common object file format header. 73
So COFF is nothing but common file format that was designed for executable files on any platform. 74
and the PE file is nothing but an executable file format built for Windows 75
environment on top of COFF header. 76
Similarly, we have the ELF file format for the Linux environment. We have MachO for 77
Mac operating systems. So after the COFF header, 78
we have the optional header then we have these sections and how those sections are mapped into the 79
memory 80
so if you look at the PE file from a very high level it would primarily have two parts. 81
One is the headers and the other one is this section. The header would basically consist of things 82
like dos header, PE header, optional header and the section table. 83
So let us look at a very simple example. 84
We'll be using a tool called CFF explorer 85
let us look at a very simple example. 86
We'll be using a tool called CFF Explorer or common file format explorer. 87
This is a very simple tool to parse COFF file format. 88
If you have followed the previous videos then this will come pre-installed with your FLARE VM setup. 89
If not you can just search for it on Google and download this particular tool. 90
its easy to find 91
So let's load an executable. You can basically load any executable into CFF explorer 92
that is available on your Windows machine. 93
Our whole purpose is to just look at the different sections of the file and look at the hex version 94
off and file and how we can quickly identify by looking at Hex Bytes that OK this is portable executable 95
file. 96
So it's expanded. Once the PE file gets loaded in CFF, this is how it will look like. On the 97
left-hand side you'll see all the parsed headers and sections that it could identify. 98
Then there will be bunch of other options as well. 99
Let's look at the hex editor. So this is how a PE looks like in a hex editor. 100
It starts with MZ as the magic bytes. 101
So this is the first and foremost way to identify whether the file is a PE file or not. 102
So if we go to our presentation, we mentioned that the header of a PE file would begin with DOS header 103
and this is a DOS header that we are talking about. 104
So MZ is nothing but a magic number of the PE file. 105
Then it consists of a DOS stub which is called 106
"This program cannot run in DOS mode" 107
This is more like a legacy thing. 108
If the PE file gets executed in a non-DOS environment, this is the error that would come up. 109
It's not something which is used these days but you know it's it's really difficult to remove it 110
without breaking a bunch of softwares. 111
So it's more like a legacy thing it's not really useful. 112
if you move down further you'll see that there is a section called PE. Portable executable files 113
header begins after the DOSstub ends. 114
So the magic number of portable executable file is PE 00 00 so if you look at the hex presentation 115
is it's 50 45 00 00. 116
So that's our PE header the one that we have highlighted here. 117
So this is how we can easily identify that this is a portable executable file that can run inside of 118
windows environment. 119
So if you keep moving down you'll have things like the optional headers which which would contain lot 120
of other details about the file and we look at the option header in much more detail in the next video 121
because it requires a lot more detail parsing and separate tools to really look at what these random 122
values actually translate into. Text data, resource 123
This is basically the section piece. 124
This particular part of the PE file. So that's where the section part starts. 125
This would contain all the code related information all the API related information about the PE file. 126
So this was just a quick demonstration to get you started about analyzing PE file. 127
Understanding how we can recognize a PE file by looking at its magic bytes and things like that. 128
Thanks a lot for watching the video.