Hey everyone, it's Sedat here. Grab your coffee, and let's dive into some 'dangerous' waters today—but don't worry, we've got our life jackets on.
Cybersecurity trends are shifting so fast that sometimes we forget to sleep just to keep up. It used to be simple: upload a file to VirusTotal, see a 60/60 'clean' report, and install it with a sigh of relief. Or we’d bump our passwords from 8 to 16 characters and feel invincible. But times have changed. Today's malware is built to commit suicide the moment it realizes it's being watched, roam through memory like a ghost, or only wake up when a specific date or time hits. Nobody trusts a 'static' hash anymore. But what about dynamic analysis? Is that enough on its own?
Today, we’re going to talk about the inner workings of those 'weird' files we encounter at testCompany, what to watch out for during analysis, and most importantly, how these beasts bypass our defense mechanisms.
Static Analysis: Laying the Corpse on the Autopsy Table
Malware analysis generally moves along two tracks: Static and Dynamic. Static analysis is the process of inspecting a file without actually running it. Think of it as a surgeon looking at X-rays before heading into the operating room.
The first place to look is the PE (Portable Executable) structure. In the Windows world, every .exe, .dll, or .sys file follows this format. Here, the Import Address Table (IAT) is a gold mine for us. Which libraries is this file calling? Is it calling CreateRemoteThread from Kernel32.dll? Or is it trying to reach the internet via Wininet.dll?
Think about it: why would a simple calculator app need to import InternetOpenW or HttpSendRequestW functions? That’s where we start smelling something fishy.
Entropy Analysis: I know you guys love this concept. If a file has high entropy (usually 7.0 or higher), it's likely packed or encrypted. Attackers obfuscate their code specifically to make our lives harder during analysis.
Defanged Example - String Analysis:
If you run a file through the strings command and see patterns like these, you should definitely be raising an eyebrow:
http[:]//bad-actor-domain[.]com/c2/checkin
C[:]\\Windows\\Temp\\update_service.exe
cmd.exe /c powershell -ExecutionPolicy Bypass -File ...
(Note: URLs and file paths have been defanged for educational purposes.)
Dynamic Analysis: Putting the Beast in a Cage and Watching
Static analysis is done, we've taken the X-rays, but we're still not 100% sure. Now it's time to throw the file into a 'Sandbox.' But be careful! A smart piece of malware can tell when it's inside a sandbox.
In your analysis lab, you need to pay attention to these things:
- Core Count: If the malware sees only 1 or 2 cores, it might say, 'This is definitely a virtual machine,' and refuse to run.
- Disk Size: Does malware run on a 40 GB disk? Nowadays, a normal user's PC is rarely under 256 GB.
- Mouse Movements: ...