Introducing FakeNet

FakeNet is Windows network simulation tool designed for malware analysis. It redirects all traffic leaving a machine to the localhost (including hard-coded IP traffic and DNS traffic) and implements several protocols to ensure that malicious code continues to execute and can be observed by an analyst.

The tool supports DNS, HTTP, and SSL protocols and provides a python extension interface for implementing new or custom protocols. It also the capability to listen for traffic to any port as well as create packet capture on the localhost.

Right now the tool only supports WinXP Service Pack 3. The tool runs fine on Windows Vista/7 although certain features will be automatically disabled.

Links:

• http://practicalmalwareanalysis.com/fakenet/
• http://sourceforge.net/projects/fakenet/

EXEInfo PE

Here's a new tool that I discovered recently that able to identify common packers. It is similar to PEiD that I used.

Goto http://www.exeinfo.antserve.com/ to get a freeware copy.

REMnux 3.0 is Ready

REMnux is a lightweight Linux distribution for assisting malware analysts in reverse-engineering malicious software. This is version 3.0 of the REMnux distribution.

To learn about REMnux and for tips on getting started, please visit http://REMnux.org.

There are 2 versions available for download at http://sourceforge.net/projects/remnux/files/version3/:

• Live CD ISO (830MB)
• VMware virtual appliance (717MB)

You can refer to http://zeltser.com/remnux/ for the list of malware analysis tool set in REMnux.

Malware Analyser

A malware analysis tool, Malware Analyser, now has a new home at http://www.malwareanalyser.com/

It is written in Python, and it is a freeware tool to perform static and dynamic analysis on malware.

Here's a few of the features:

• String based analysis: API, DLL, registry, etc.
• Showing PE header, symbols.
• Code analysis by disassembling
• Check for packer.
• etc.

It can be downloaded from:

• http://www.malwareanalyser.com/home/malware_analyser 3.0.zip

Updating Malware Cookbook DVD Tools

If you haven't got yourself a copy of Malware Analyst's Cookbook, do it now, then you may download the DVD tools which available online. This is a must-have if you are serious in REM.

I just did it by:

$ cd ~/rem 

$ svn checkout http://malwarecookbook.googlecode.com/svn/trunk/ malwarecookbook-read-only

Windows PE Header

Understanding Windows PE Header is essential to perform Reverse Engineering Malware.

Each executable file has a COFF (Common Object File Format), which is used from the OS loader to run the program. Windows Portable Executable (PE) is one of the COFF available in Windows Operating System, while the Executable Linking File (ELF) is the main Linux COFF.

Microsoft migrated to the PE format with the introduction of the Windows NT 3.1 operating system. PE/COFF headers still include an MS-DOS executable program, which is by default a stub that displays the simple message "This program cannot be run in DOS mode" (or similar). PE also continues to serve the changing Windows platform. Some extensions include the .NET PE format (see below), a 64-bit version called PE32+ (sometimes PE+), and a specification for Windows CE.

MZ are the first 2 bytes you will see in any PE file opened in a hex editor. The DOS header occupies the first 64 bytes of the file - ie the first 4 rows seen in the hexeditor in the picture below. The last DWORD before the DOS stub begins contains 00h 01h 00h 00h, which is the offset where the PE header begins. The DOS stub is the piece of software that runs if the executable is run from DOS environment (for example DOS shell). For retro-compatibility it often executes a printf("This program must be run under Win32");. 

The PE header begins with its signature 50h, 45h, 00h, 00h (the letters "PE" followed by two terminating zeroes). If in the Signature field of the PE header, you find an NE signature here rather than a PE, you're working with a 16-bit Windows New Executable file. Likewise, an LE in the signature field would indicate a Windows 3.x virtual device driver (VxD). An LX here would be the mark of a file for OS/2 2.0. FileHeader is the next 20 bytes of the PE file and contains info about the physical layout & properties of the file e.g. number of sections. OptionalHeader is always present and forms the next 224 bytes. It contains info about the logical layout inside the PE file e.g. AddressOfEntryPoint. Its size is given by a member of FileHeader. The structures of these members are also defined in windows.inc.

Not all these section must be used, but you need to modify the NumberOfSections to add or delete sections from a PE file. The best way to analyze those section is by using PEExplorer or PEID.

EntryPoint is The Relative Virtual Addresses (RVA) of the first instruction that will be executed when the PE loader is ready to run the PE file. If you want to divert the flow of execution right from the start, you need to change the value in this field to a new RVA and the instruction at the new RVA will be executed first. Executable packers usually redirect this value to their decompression stub, after which execution jumps back to the original entry point of the app the OEP. Of further note is the Starforce protection in which the CODE section is not present in the file on disk but is written into virtual memory on execution.

ImageBase is the preferred load address for the PE file. For example, if the value in this field is 400000h, the PE loader will try to load the file into the virtual address space starting at 400000h. The word "preferred" means that the PE loader may not load the file at that address if some other module already occupied that address range. In 99% of cases it is 400000h.

SectionAlignment is the granularity of the alignment of the sections in memory. For example, if the value in this field is 4096 (1000h), each section must start at multiples of 4096 bytes. If the first section is at 401000h and its size is 10 bytes, the next section must be at 402000h even if the address space between 401000h and 402000h will be mostly unused.

FileAlignment is the granularity of the alignment of the sections in the file. For example, if the value in this field is 512 (200h), each section must start at multiples of 512 bytes. If the first section is at file offset 200h and the size is 10 bytes, the next section must be located at file offset 400h: the space between file offsets 522 and 1024 is unused/undefined.

SizeOfImage is the overall size of the PE image in memory. It's the sum of all headers and sections aligned to SectionAlignment.

SizeOfHeaders is the size of all headers + section table. In short, this value is equal to the file size minus the combined size of all sections in the file. You can also use this value as the file offset of the first section in the PE file.

DataDirectory It is the final 128 bytes of OptionalHeader, which in turn is the final member of the PE header IMAGE_NT_HEADERS. DataDirectory is an array of 16 IMAGE_DATA_DIRECTORY structures, 8 bytes apiece, each relating to an important data structure in the PE file. Each array refers to a predefined item, such as the import table. The structure has 2 members which contain the location and size of the data structure in question: VirtualAddress is the relative virtual address (RVA) of the data structure , and isize contains the size in bytes of the data structure.

Windows PE Header

References:

• http://marcoramilli.blogspot.com/2010/12/windows-pe-header.html
• http://www.osdever.net/documents/PECOFF.pdf
• http://www.skyfree.org/linux/references/coff.pdf
• http://www.woodmann.com/RCE-CD-SITES/Library/M_Pietrek_Book/PietrekBook.pdf

Free Computer Forensic Tools

This is a handy list for forensic and IR work. Any update of the list will be announced on twitter.com/jonathankrause

Currently the list is divided into the following categories:

• Disk Tools
• Email Analysis
• General
• File & Data Analysis
• Data Analysis Suite
• File Viewers
• Internet History Analysis
• Registry Analysis
• Web Application Analysis

The full list can be obtains at http://forensiccontrol.com/fcresources.php

Introduction to Java Examination

There is an article posted by Corey Harrell, (Almost) Cooked Up Some Java. It introduces the steps he took to examine the java. This article includes:

• Understand the Java cache folder.
• Examine the IDX file.
• Examine the JAR file.
• Extract Java source from the JAR file.
• Examine the Java source code.

Analyzing Suspicious PDF Files With PDF Stream Dumper

Analyzing Suspicious PDF Files With PDF Stream Dumper: "
Targeting a vulnerability in Acrobat Reader is one of the more popular ways of compromising systems nowadays. PDF Stream Dumper is a free tool for analyzing suspicious PDF files, and is an excellent complement to the tools and approaches I outlined in the Analyzing Malicious Documents cheat sheet.

For this introductory walk-through, I will use a malicious PDF file that I obtained from Contagio Malware Dump. If you’d like to experiment with this file in an isolated laboratory environment, you’re welcome to download the malicious PDF from my server; the password to the zip file is the word “infected”.

PDF Stream Dumper is a self-contained program that runs on Microsoft Windows and contains a convenient graphical user interface. The tool contains numerous features. I will only touch upon some of them here.

Examining a PDF File for Suspicious Characteristics

After installing PDF Stream Dumper, load the suspicious PDF file into it and start looking around. The tool includes a number of signatures of known PDF exploits. To scan the file, select “Exploits_Scan” from the menu:



In this case, PDFStreamDumper identifies the exploit and specifies where it’s present in the PDF file:

Exploit CVE-2007-5659 - collectEmailInfo - found in stream: 31

You can use the left pane of the tool to navigate through the file’s objects to examine their contents. The tool will decode steams where necessary. For instance, viewing the steam in object 31 shows us embedded JavaScript:



Another way to locate suspicious objects within the PDF file is to use the tool’s “Search For” feature, which can automatically locate JavaScript, Flash objects among other entities:



Examining Malicious JavaScript in the PDF File

When looking at JavaScript embedded in a PDF object, we can click the “JavaScript_UI” button to bring up the interactive JavaScript viewer and interpreter, which is built into PDF Stream Dumper:



Sometimes, the scripts embedded into PDF files are obfuscated. PDF Stream Dumper allows you to run these scripts using the built-in interpreter, which can help you deobfuscate them.

In the example we’re examining now, the script isn’t obfuscated. It seems to contain Unicode-encoded text, which is probably shellcode:



Examining Shellcode Embedded in the PDF File

Shellcode is typically used to store the payload of the exploit—the malicious code that will be executed on the victim’s system. PDF Steam Dumper provides several tools for understanding the capabilities of the shellcode embedded into the file though its “Shellcode_Analysis” menu.



For example, we can select “scSigs” to emulate the execution of the script using the built-in LibEmu engine and look for signatures of the API calls often present in shellcode:



The tool recognizes the signatures of WriteFile and WinExec. This shellcode probably uses these calls to save and execute a malicious windows executable, which it might download from the Internet or which might be embedded into the PDF file itself.

We can get another perspective on the shellcode by running it using the built-in iDefense shellcode logger module “sclog”:



The tool shows us that the shellcode executes the GetFileSize API call. This is often used as part of malicious document files to locate code embedded into the file. Most likely, this shellcode uses GetFileSize to locate the malicious executable embedded into the PDF.

We now are reasonably certain that we’re dealing with a malicious PDF file that exploits the CVE-2007-5659 vulnerability in Acrobat Reader to extract and run a malicious executable embedded in the PDF. We’d need to perform additional steps to extract and examine that executable, but that is outside the scope of this brief note.

If you like analyzing malicious programs, take a look at the Reverse-Engineering Malware course I teach at SANS. If you’re just getting to know malware, you might also like my Combating Malware course.

— Lenny Zeltser

Attack Surface Analyzer BETA

The Attack Surface Analyzer beta is a Microsoft verification tool now available free for everyone to highlight the changes in system state, runtime parameters and securable objects on the Windows operating system. This analysis helps developers, testers and IT professionals identify the attack surface caused by installing applications on a machine.


Attack Surface Analyzer takes a snapshot of your system state before and after the installation of product(s) and displays the changes to a number of key elements of the Windows attack surface. The tool takes snapshots of an organization's system and compares ("diffing") these to identify changes. The tool does not analyze a system based on signatures or known vulnerabilities; instead, it looks for classes of security weaknesses as applications are installed on the Windows operating system.

The tool also gives an overview of the changes to the system Microsoft considers important to the security of the platform and highlights these in the attack surface report. The Microsoft Security Development Lifecycle (SDL) requires development teams to define a given product's default and maximum attack surface during the design phase to reduce the likelihood of exploitation wherever possible. Additional information can be found in the Measuring Relative Attack Surface paper.

Some of the checks performed by the tool include analysis of changed or newly added files, registry keys, services, ActiveX Controls, listening ports, access control lists and other parameters that affect a computer's attack surface.


Download the free tool (x64 and x86) at http://www.microsoft.com/downloads/en/details.aspx?FamilyID=e068c224-9d6d-4bf4-aab8-f7352a5e7d45&displaylang=en

Related article:

• SDL Tools

REMnux Version 2.0 is released

REMnux is a lightweight Linux distribution for assisting malware analysts in reverse-engineering malicious software. REMnux version 2 was released few days back.

Download the new version of REMnux from its main page as a virtual appliance and/or as a Live CD. Here're the quick highlight of the tools it supports.

Malicious Websites Analysis:

• Updated version of Jsunpack-n (proxy support, encrypted PDF handling)
• Includes Stunnel (for interception of SSL sessions)
• Includes RABCDAsm toolkit for RE malicious Flash (SWF) programs.
• Includes tor and torsocks (for anonymizing interactions with suspicious websites)
• Includes Burp Suite Free Edition.

Memory Forensics:

• Updated Volatility memory forensics framework to version 1.4 RC 1 (support Vista and 7). 
• Includes AESKeyFinder and RSAKeyFinder tools (for finding AES and RSA keys in a memory image).

Others:

• Includes pyOLEScanner.py (for analysis of malicious Microsoft Office documents).
• Includes libemu library to obtain the “sctest” tool (for shellcode analysis).
• Added the “whois” utility.
• Added xortools.py and pescanner.py tools (from Malware Analyst’s Cookbook).
• Installed VBinDiff for viewing and comparing files.
• Installed ircII to supplement the Irssi IRC client.
• Added the VirusTotal VTzilla Firefox extension.
• Added md5deep to assist with hash calculating-operations.
• Added ClamAV for manually scanning suspicious files and generating signatures.

Memory Analysis with Mandiant Memoryze

There is a great article posted by ctilbury on Digital Forensics How-To: Memory Analysis with Mandiant Memoryze.

It introduces 2 tools, Memoryze and Audit Viewer. Both are available free at Mandiant. The article shows:

• How to install Memoryze on USB as incident response kit.
• Work through the steps to acquire a memory image.
• Outline the potential issue/solution with memory acquisition.
• Performing live memory analysis.

Mandiant: Forensic and Incident Response Tools

Below is the list of tools that I used to perform forensic and incident response. All are available at Mandiant free software.

1. MANDIANT IOCe is a free editor for Indicators of Compromise (IOCs). 
2. Memoryze - A free memory forensics software designed to help incident responders find evil within live memory.
3. MIR Lite-CDT - A command line utility based on technology from MANDIANT's Intelligent Response enterprise product.
4. Audit Viewer - An open source tool that allows users to examine the results of Memoryze's analysis.
5. Highlighter - Designed to help network analysts rapidly review log and other structured text files.
6. Red Curtain - A software for incident responders that helps find and analyze unknown malware.
7. Web Historian - Assists users in reviewing websites that are stored in the history files of the most commonly used browsers.