Hello and welcome back.
This is a practical exercise walk through for a real girlfriend somewhere in a previous setting, I've
got to ask you to.
They define asleep and I put it on to my desktop here.
Now, the content of the zipper contents to to the ransom note.
Right.
So, Peter, don't be an extension and public key.
The been has been put there so that you do not accidentally click on it to execute it in a real way.
It doesn't have to be an extension, but an extension.
The public is necessary as a barometer for this and to run.
So now the first thing you want to do is to check whether this was created, the net framework or some
something else, like a network.
I see all other things to do that we need to use the IEEE.
So if you are.
Yeah.
Which is over here.
You will find that it is done, it executable.
You opened the of the real melee.
And you can see it, he's done it executable, we've done it.
And the fact that although he says that the little bit we this is not definitive, even though the father
to be instead of 64, you know, to be definitely sure, we need to use another tool seized on.
It can be fixed before we even know his history to be sold to we're going to use requires a command
line search for developer coming from an openly.
And again, we are going to copy the path and take a path to that path and then use a Common Core conflict.
Call Flex, followed by the name of the executable you want to scan it into, if you see here today
to be brief is zero.
That means city for the city for Internet application.
If you get a little bit of practice one, then it is that to be done in application.
So in this case, it is zero and this is a 64 bit ton application.
Therefore, we need to use the by 64 bit.
So that is open the Espina.
He's here.
So instead of using the newspapers, we can also use strings to scan for strings so we can type the
common strings, followed by the name of Hee Hee Hee Hee.
There are a lot of strings here.
And you can feel the strings telling me if maybe you're interested in whether this table has got any
kind of encryption ability, you can pull the strings like this.
You can me to direct, followed by assuming you are looking for those strings that contain the word.
So you hit enter and now you see these are names of strings that are found that contains everything
inside from here you can see days and fall and strings of string theory.
So these are indications that this malware has the ability to obfuscate or to encrypt files.
So these are some hints for you as to what is capable.
Now we open it inside our audience by just drag it into our audience.
And the name of the executable is of India.
And from here, you can see the entry point is in the program, doesn't mean.
It is one week into the entry point, yeah, it's a good entry point is to expand on this Reichling
on this and click the go to entry point.
And this is your entry point.
And you can see here the entry point.
You the program mean program.
And this is mean, you also notice in other piece called s.E.C probably encryption modu, so they said,
I see what's happening here.
Looking at this, you can see that this program is looking for whether they are giving back to the program.
He is checking it.
So they suggest it requires an argument when the program started and this is argument that we should
pursue.
Now, this malware comes in to pass, to follow.
And as I mentioned before, this beautiful High-Tech filing, as well as the public, which to be which
is to be passed, has an argument when you're running this program.
So there is no argument that the program will quit.
But if the argument is is positive, then you can continue to run.
And you can see here in Virginia, after checking whether the argument is exist, you will go and really.
Oh, here is checking a man is following this, and then he's going to really a strike the public,
he.
And to this static variable, static variable are variables which are created object you cannot own
because the name of the class is Mingenew instead of an object.
So in this case, the name of the class is service used here.
Therefore, this is static where you click on it.
Now you can see how variable is playing in the backspace.
But after reading the content on this publicly, you see here.
And then in the next line here, you see is checking whether the directory of certain directory exists
and if he doesn't, if he's doing this, then he will go time here and create it, actually.
So let's check and see what exactly is he checking for less clear on this.
So here he is using the function for the power to create a directory.
So in order to know the name on it right here, we need to click and put a breakpoint here.
And then you run to hit a break point and then we analyze the return value for string.
So we can through this stuff and then here you must pass the name of this fall as a barometer.
So it just right click on this and we nimi.
And then Copiah, the funny.
Base the funding here.
And in Cleveland, Kate.
Yes, and they run so that you hit this breakpoint.
So let me step into this.
So we're going to step into this and we see the tintype here.
So we just put a break point here for the return and then we run again.
So did you hit this very point?
And here you see a tax that is returning is programmed to.
So he's looking for his dietary program data, we can copy this copy value and put it in our notes for
the.
We here, so we know that it is looking for this directory of polling data.
Can I step out of it and tell you about here?
OK, so now we know that the director is looking for his program, that data, so he can stop it now.
And he Backspacer, go back to our main program where we were analyzing spacing in.
So here today, he's looking for his program data and now he says he would like to create a directory.
He can go to the location.
That we captured just now see program to.
Dyle Kinzie program later.
So somewhere down here, one of these files here is the malware document, malware for the and then
here you see this is just a just a young instruction doesn't do anything.
You just concatenate some strings together.
So this is one example of obfuscation where you deliberately insert some Joung instructions to throw
you off.
And the same thing is probably Hayesville.
And here is where he's trying to start a thread.
All right, and then down here, you can see that it is creating some strength.
He's creating a real drives, this area is coming from here, very real drive, and if you click on
this, you can see what he's doing.
And this one, you can see the.
Dysfunction is trying to check if the that it is now checking for is going through every draft letter
in Saluzzi dry inside your computer setting with ABC TV's on.
And for every hour of the day that he enters, he is checking whether you are inside the system.
Directress you can see in India and so on.
And it is not in the system that is.
Then on you proceed to the next one.
You get all the files in that particular folder checking for.
The name of the father, full name of the father is signing directory, and this is a.
And for each of the extension of the file and then here.
He's checking whether the file extension matches.
Something so let's was just so we're clear on this.
And here it is trying to create an array out of these types types.
He's referring to this.
So here is again, obfuscation, but we can use a debugger to have the office.
All right.
So our continuing next video.
See you then.