It is also useful to investigate the information found using external sources such as intelligence tools.
So, for instance.
You can search the web domains that this.
Malware connects to, for example, Adobe.
This is probably not a legitimate website, but because Adobe, as I remember, doesn't have domains
like that.
But we will check this out.
Adam a flasher up.1.com.
And let's also run the rule here.
Java Oracle two dot rule here.
Java Oracle two dot room.
And here we.
We can use the expressions, probably.
Rule.
Come.
And here we will have.
Net.
Nothing.
Argh!
Nothing.
Come again.
Yeah that's I think that's two websites is okay.
So as I said, it's also useful to investigate the information found using external sources such as
the VirusTotal, for instance.
We have these two websites that are malware has some relation to which we will check that out right
now.
So VirusTotal.
Dot com.
And after that we will give these websites to VirusTotal to check if it has something malicious insiders
or someone reported something malicious about this websites and we can go to community.
Read this here.
It has the hybrid analysis.com sample.
Let's check this out.
Here.
We have incident response.
Someone did it.
So network behavior contexts.
Five domains and two hosts.
Let's see all of the hosts here.
So the web flasher abc.com.
This is a we can do osint bootzilla that through Java Oracle to that through here.
So it's a bit malicious here.
So from Germany to.
Contacted countries in the United States, we have the Http traffic with hybrid analysis that come here.
As the name suggests, it is the analysis website.
So you can website like.
Enter malware's websites or analyze.
Here we have the PDF.
Let's have some kind of close user agent Mozilla here that PHP.
You have a CRL and so on here and in VirusTotal we have the scan results for.
Security vendors flag this URL as malicious, and apart from that, we VirusTotal can provide more useful
information that you can find by browsing through the page here.
For instance, let's go there.
The protections.
Details and so on.
For instance.
It has the final year server serving IP address.
We can also check this serving IP address here if something to do with it.
Now for now.
And malware sinkhole is Arbor Networks.
The date is written here and last analysis date is one month ago.
But whatsoever our hybrid analysis.com actually gives more detailed information about our malware.
Uh, legal.
Corporate As-salih.
Internal name is Dale.
And here as a compiler packer as Microsoft Visual C plus plus architecture for Windows and size of 200kB.
So it associated our.
Malware, this website that connects to our executable malware.
Right.
And after that, we have also so much information about that we can find out.
And so once we are done with this string analysis and open source intelligence analysis, now we will
look.
Input functions.
In the next lecture.