Static Analysis 101: The First Strike Against Malware
Basic static analysis is the process of examining a program or suspicious file without executing it.
We follow multiple techniques to achieve this, collectively known as static analysis.
Below are the steps involved in the basic static analysis methodology:
- Hash
- String
- Function/API used
- Packed or not
for understanding all process completely let us take an malware example:
BELOW IS ATTACHED LINK FOR MALWARE SAMPLE:
Extracting the zip and then you will found .7z file extracting it with “infected” password will write Malware.Unknown.exe.malz file, malz extension was added to prevent accidental execution. For static analysis we do not have to change its extension to exe.
HASH
First of all we calculate its hash, If you are in flare VM you can do it direct by right-click and then MD5 Hash or you can also write command
certutil -hashfile Malware.Unknown.exe.malz SHA256 [for windows]
sha256sum Malware.Unknown.exe.malz [for linux]
or upload the whole file to virustotal or just submit the collected hash to virustotal, here hash of the file is
MD5: 1D8562C0ADCAEE734D63F7BAACA02F7C
STRINGS
Strings, By extracting Strings, an analyst can quickly gain clues
Get CyberMonk’s stories in your inbox
Join Medium for free to get updates from this writer.
For extracting strings you can just write click on the file and select Strings or type command floss.exe (both options are for flare VM)
otherwise we have to download strings tool of sysinternals.
in strings tool, at the end we can found some outstanding findings
From this Screenshot we can find host-based indicators and Network-based indicators like commands, URL, etc. Write it down your findings, that will help us in dynamic analysis.
IAT (Import Address Table) or Windows API
Malware uses Windows API functions to interact with the system (modify registry, create processes, connect to C2 servers), so analyzing these calls reveals the behavior and intent of the malware.
to check functions used by program you can use PEView, PEStudio or Dependency Walker, but Dependency walker is best for this.
by navigating to SECTION .rdata you can see IMPORT Address Table, here you can find import functions. Remember that if binary is packed you cannot see this much of functions. From this you can review suspicious functions like DownloadFromURL, URLDownloadToFile, etc. for better idea of binary.
In Dependency Walker you can see DLL List which are used by binary and by clicking each DLL you can see what functions are called by that DLL, give attention to IMPORT functions of tha particular DLL.
PACKED OR NOT
A packed binary is a program whose code and data have been compressed, encrypted, or obfuscated using a packer tool.
to check binary is packed or not we can use tool DIE (Detect It Easy) but best way to check if the binary is packed or not is checking virtual size and Raw size using PEView.exe
open malware in PEView and navigate to “IMAGE_SECTION_HEADER .text” and check for virtual size and Size of Raw Data, if you notice major difference (after changing this size into decimal) between these size it means binary is packed , because:
Virtual Size: The size of a PE section when loaded into memory
Size of raw data: The size of the section as stored in the disk file. It represents actual bytes written in the PE file.
If file is packed you can find name of it in DIE (Detect It Easy) tool and then you have to unpack that piece of malware using same packer used for packing in malware
OR you can check on DIE (below given malware sample is different from above, I attached below photos just to show DIE tool)
In next blog we will continue DYNAMIC analysis of malware.
STAY TUNED!
