First Malware Analysis

Recently I began the process of looking for malware to start learning how to process things. Currently my skills are terrible, but I've got to start somewhere.

Found this email in my wife's hotmail as GMail would never let something like this arrive in my email. It was obvious to me it was malware as it was a “zip” file with what appears by the icon to be a Microsoft word document.

As we can clearly see Windows is not as easily fooled and properly labels it as an application. Simple Windows properties shows that it is an archive.

Using a universal extractor we obtained the following files

.text

.rdata

.data

Folder (/.rsrc)

Opening up .rdata in hex editors revels the following info

T.VirtualAlloc..©.GetCurrentProcess.¬.GetCurrentThread....CreateFileW.….GlobalAlloc.æ.EnumResourceLanguagesA..7.FindResourceExA.O.FreeResource..ö.GetModuleHandleA..9.GetStartupInfoA.X.GetTempFileNameA..Z.GetTempPathA..Œ.GlobalFree..ö.LoadResource....LockResource....MoveFileA. .SizeofResource..KERNEL32.dll..¨.DispatchMessageA..Õ.TranslateMessage..J.GetMessageA.é.UpdateWindow..¸.ShowWindow..4.RegisterClassExA..Ò.LoadCursorA.Ö.LoadIconA.•.DefWindowProcA.. .PostQuitMessage.Õ.EndPaint....GetClientRect...BeginPaint..g.CreateWindowExA.o.GetSystemMetrics....AdjustWindowRectEx....CallWindowProcW.-.CharNextA./.CharNextW.h.CreateWindowExW.–.DefWindowProcW..š.DestroyAcceleratorTable...DestroyIcon.ž.DestroyMenu. .DestroyWindow.Ï.EnableMenuItem..ì.EqualRect.î.ExitWindowsEx.ó.FindWindowW...GetClassInfoExW...GetCursorPos....GetDC...GetDesktopWindow..$.GetFocus..%.GetForegroundWindow.1.GetKeyState.U.GetParent.k.GetSubMenu..}.GetWindow.‚.GetWindowLongW..ˆ.GetWindowRect.©.IntersectRect.ª.InvalidateRect..µ.IsChild.Å.IsWindow..Í.KillTimer.Õ.LoadCursorW.Ù.LoadImageW..Þ.LoadMenuA.ã.LoadStringA.ä.LoadStringW.ó.MapWindowPoints.ÿ.MessageBoxW...MsgWaitForMultipleObjects...OffsetRect....PeekMessageA..).PtInRect..3.RegisterClassA..5.RegisterClassExW..L.ReleaseDC.N.RemoveMenu..c.SendMessageW..p.SetCursor.y.SetFocus..z.SetForegroundWindow.ž.SetTimer..¥.SetWindowLongW..§.SetWindowPos..¨.SetWindowRgn..Ä.SystemParametersInfoA.Å.SystemParametersInfoW.Ð.TrackPopupMenuEx..Ú.UnionRect...wsprintfA...wsprintfW...wvsprintfW..USER32.dll..ô.GetStockObject....LineTo..!.MoveToEx..F.Rectangle...CloseMetaFile.0.CreateDCW.E.CreateMetaFileW.N.CreateRectRgnIndirect.Í.DeleteDC..Ï.DeleteMetaFile..µ.GetDeviceCaps...LPtoDP..P.RestoreDC.W.SaveDC..{.SetMapMode....SetViewportOrgEx..“.SetWindowExtEx..”.SetWindowOrgEx..GDI32.dll.Y.RegOpenKeyA.ADVAPI32.dll..".Shell_NotifyIconA.SHELL32.dll...CoCreateInstance..%.CoGetClassObject..=.CoInitialize..R.CoRegisterClassObject.^.CoRevokeClassObject.f.CoTaskMemAlloc..g.CoTaskMemFree.h.CoTaskMemRealloc..k.CoUninitialize..z.CreateDataAdviseHolder..‚.CreateOleAdviseHolder.ù.OleLoadFromStream...OleRegEnumVerbs...OleRegGetMiscStatus...OleRegGetUserType...OleSaveToStream.H.WriteClassStm.ole32.dll.z.memcpy...._XcptFilter.%.__dllonexit.(.__getmainargs.:.__p__commode..?.__p__fmode..Q.__set_app_type..S.__setusermatherr.._._acmdln.m._adjust_fdiv..w._c_exit.z._cexit..‡._controlfp..›._except_handler3..¤._exit.Æ._ftol.ç._initterm.`._onexit.m._purecall.Ì._wcsnicmp..._wtoi.,.exit..A.free..t.malloc..Š.realloc.«.strtol..Ã.wcschr..Ä.wcscmp..Ð.wcsstr..msvcrt.dll

We can see the control triggers for what appears to be a Trojan remote control software. I had to break up the xml so that the blog will actually display the results.

Inside the folder, we see:

< ? xml version="1.0" encoding="UTF-8" standalone="yes"? >....    < assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" >....       < trustInfo xmlns="urn:schemas-microsoft-com:asm.v3" >....         < security >....           < requestedPrivileges >< requestedExecutionLevel level="asInvoker" uiAccess="false"/ >< /requestedPrivileges >....         < /security >....       < /trustInfo >....    < /assembly >

This provides improved remote control over the computer

http://blogs.msdn.com/b/cjacks/archive/2009/10/15/using-the-uiaccess-attribute-of-requestedexecutionlevel-to-improve-applications-providing-remote-control-of-the-desktop.aspx

Compiled with

T.h.i.s. .i.n.s.t.a.l.l.a.t.i.o.n. .w.a.s. .b.u.i.l.t. .w.i.t.h. .I.n.n.o. .S.e.t.u.p..
http://www.jrsoftware.org/isinfo.php

It is officially declared as Trojan-Downloader.Win32.Kuluoz.D

http://telussecuritylabs.com/threats/show/TSL20131022-08

Oh, Cisco...

I'll start this post off with that video because I feel great that my Cisco CCENT is out of the way at WGU, course COV1.
Its been a long month and a half for me. First I had an umbilical hernia surgery, quit a temp job because they weren't giving me the time off I needed to recover from the surgery. Next got sick with a nasty flu, followed up with family visiting for Thanksgiving. At the end of all that, my family and I caught a severe cold which turned into acute bronchitis. I am feeling 95% better now, I just have this terrible lingering cough which I've read on the internet is going to last possible 20 or so day. I'm on Day 15 and it doesn't seem to be getting better, so after Christmas, if I still have it, I'll be heading into my VA clinic to see if I can get something to clear it up.

So enough about that crap. About the CCENT test, lets see if I can come up with any pointers. Focus a lot on the subnetting stuff. It really will help. I know I hate it, and I have a lot of tables memorized because I hate it. Yes, I do know how to subnet and do the binary math, I just find it time consuming and rather use the shortcuts I know of. Next big section was the troubleshooting section. I had "four" questions that were troubleshooting. The reason why I quoted that was because the "four" was actually "16" because each problem and four additional questions that you had to answer. Throw in a few IPv6 stuff and some security and it summed up the test for me.

Whats next on my plate at WGU? Leadership Concepts and Applications (RIT1). I just want to shoot myself now. I really don't care for this topic as I find a lot of it BS, but I gotta do it. I just started reading my first chapter and I already feel the need to go take some Tylenol. I'm hoping to get this done in just a couple weeks. That is if I get off this blog and my other websites and actually read the chapters.