Welcome back.
In this video we'll analyze another round somewhere we practice the same techniques and learn a few
new tricks
same as before we prepare the few filters in process.
Morning thaw that will match the name of the binary and the right file operation
notice that in order to hide its actions these binary dropped another binary as FEC hosted that except
in a strange looking folder.
That meaning salad GOP made Adobe folder
Process Explorer has a very useful feature that allows us to check for digital signatures of the binaries
by clicking the verify button.
No surprise here the SBC host that takes it is not signed
let's have data filters now and watch the activity of the second binary as we see host that exit.
Go ahead and type it.
Notice there is a visible pattern of file offset to be encrypted it modified one byte skip 2048 and
repeat hardly any real encryption at all
this pattern seems to be the same for all the files.
This means that the headers of all access to the boss will be corrupted giving the impression of a more
serious infection
let's see what's actually happening and the reverse engineer these obfuscation
opened the file inside uproar and navigate to the location of the right file API call.
As we've been doing in the previous lecture we remember right
remember the shortcut for John plaid dress
used the space to toggle between disassembly and graph view
Remember also to enter your comments.
The buffer parameter of the right file call contains the modified byte any story in the E X register
highlight eat and IDR will show all or eat or occurrences as we saw.
This has to be modified from outside the current function.
These must be the so-called encryption.
In fact we're dealing with four beat wise operations applied to a single byte
and the operations
we can see on the screen.
The sequence
bear with me
one more thing Worf noticing here is that the calls to standard Windows API eyes are not obvious straight
away
we can see they are wrapped in one or two extra.
It's not the problem at all for either little
thank you for watching and see you in the next lecture.