Hello and welcome to a new session.
In this video, we are going to talk about the principles of dot net and Java malware analysis.
The first thing we are going to look at, the differences between interpreted it was compile programs,
compile languages, convert the Soska into interpretive languages.
This is being translated into Ambika representation.
So examples of compiling these are like C o C++.
But for interpretor languages have, for example, Java and ONet.
So for computer languages, this is the workflow, the source code on the left here, CCP stands for
C++, is being used by the compiler to convert it into machine code.
And then when the program runs, a machine code is loaded into memory and instruction site operated
by the CPU and execute it.
So we have a machine code which is native to that particular machine.
No interpreter languages, they can be slight differences.
So, for example, is his second language.
He has to go through a compiler aswell, the compiler, but also convert it into a B, far from it,
which is called Ambika.
By this, Piku is different from this machine.
This machine could also be far from it by this machine or is native to this machine.
That means he can definitely run in the CPU by here.
Now bytecode, even though it is a B far from it, cannot run directly by the CPU.
He needs to be interpreted by a virtual machine.
And this which a machine could be a dot net framework or it could be a Java runtime environment.
So that is a difference.
But so the Bikel is an intermediate language.
It is not complete native formic, but it is something in between the source code and a shingle now
because in Java by code can be different back into the source code with relative ease, programmers
use of discretion to make it harder to analyze the code after the completion.
We have to say, can you compare this by code that into the accuracy?
So that is why many programmers, including many authors who find ways to make it harder to analyze
the decomposers, could slow that process or making it harder to decompiled back in understanding,
analyze its called confiscation.
Obfuscation comes in many forms.
These are four of the main ones.
We have string manipulation and or nonsensical.
Nemi is one of the most prevalent ways we can also use inclusion of unnecessary code to slow down the
analysis.
Also, there could be use of encoding or encryption.
And next is the N.T. analysis, which can also prevent your tools from analyzing.
Nonsensical naming or fashion variables?
This is an example, it, for example, here we have a method or function, and in this case you can
see this technique is used to keep the name of the function.
So when the analyst reaches, it has no clue as to what the purpose of this function.
And so here you can also see all the functions of the various classes has been renamed to make it sensical
and harder to understand.
The next one is string manipulation, string manipulation is where you take a long, normal string and
put it through a complicated process by breaking up the string into various parts and using functions
on each part and then concatenating those functions to to build up the origin of the string.
For example, you take a look at this here.
The dysfunction gatefold above is to get in the path of the location where the file is located.
However, you put through a complicated process where you call multiple functions.
So, for example, here you have a function here which concatenate three of the double backslash and
then that is concatenate that further with her decryption function.
And in this case, it is he?
S decryption function, which takes a parameter, this encrypted string and of course, the Sonisphere.
And after this thing has gone through the functions, we get back to the original directory.
So this is where a string containing the directory location is being deliberately broken up into various
components.
Each component is put through a function in order to convert it back to the strings of the concatenation.
And next time, use uses unnecessary instruction.
So in this example, you will see many functions being created, just a trophy analysis.
If you take, for example, here the first function, if I see so on and look into it, it just returns
a number.
So this number is not used anywhere else in the code.
So this actually is put to the analysis into confused, and that is whether in the same thing is true
for all this as well.
Yeah.
Put that as unnecessary instructions.
So that's all for this video.
Thank you for watching.