Web Malware 101

We need to understand the flow and monitor the variables in malicious browser scripts. For this Script Debuggers and Script Interpreters are necessary.

Some Open Source Tools:
Creme Brulee
Firebug – Firefox plug-in
Google Chrome Developer Tools
Javascript Deobfuscator – Firefox plug-in
JSDebug
Malzilla
Rhino
SpiderMonkey + V8
The Mina

Microsoft Tools:
Microsoft Script Debugger
Microsoft IE8 Developer Tools
Cscript and Wscript - Execute JavaScript and VBScript outside the browser.
Internet Explorer 8 comes with a powerful debugger installed.

Lets see an example of obfuscated script. The target here is Storm worm. This worm started spreading in January 2007. It used e-mail messages with subject lines about weather disasters in Europe, hence the name.

Lets inspect the javascript which has the obfuscation function shall we,


function xor_str(plain_str, xor_key)
{
var xored_str = "";
for (var i = 0 ; i < plain_str.length; ++i) xored_str += String.fromCharCode(xor_key ^ plain_str.charCodeAt(i));
return xored_str;
}

var plain_str = "\x94\xbe\xbe\xbe\xbe\xbe\xbe\xbe\xbe\xbe .... really long chars ...9d\x8f\xbe";

var xored_str = xor_str(plain_str, 180);
document.write(xored_str);

The main exploit code here is obfuscated and stored in a string variable plain_str. The code calls obfuscation function xor_str(), the output from this function is passed as input argument to document.write().  Thus to see the deobfuscated code, we will have to set a breakpoint on document.write(xored_str)  line and then examine the content of xored_str variable before it gets executed by document.write().

Malzilla
To analyze Storm we will use Malzilla. Click on the Decoder tab in Malzilla, then right click in the top frame and click 'Load  from File'. This allows you to load the malicious script into Malzilla.

Then click 'Run script' button. We can see the deobfuscated in the window below.

Sometimes there may be multiple layers of obfuscation where the first obfuscated script needs to be deobfuscated as well. In this case copy the script from the lower pane and paste it in a new tab and repeat the process.

The deobfuscated Storm script contains additional JavaScript that once executed by the victim browser will attempt to exploit an Internet Explorer vulnerability to download and execute a malicious program.

CaptureBat - Dynamic Malware Analysis Tool

As I mentioned in one of my previous posts about tools for Dynamic Malware Analysis, CaptureBat is a very essential tool for this purpose. This tool shows us verbose output of the things happening at the registry, file and processes level.

Starting off with Capture Bat
One of the easiest ways to go through the information captured by this tool is to copy the output in a text file for easy reference

But this limits the overall efficiency as it can geta little cumbersome to go through the captured data of a malware which was running for about 5 minutes or so. Its always good to have a way in which we can categorize, search and filter the contents to our liking. Guess what, we already have a way...Excel.

Efficiency through Excel
We can export the captured data into an excel sheet and take benefit of the excellent filtering capabilities. T start off, simply capture the data in a normal CaptureBat file and import it into excel.

When Importing into Excel choose file type as 'Delimited'.






As of now I have observed that choosing the options 'Tab', 'Space' and ':' in 'Other' works best for me.



Once done, we get the output in an Excel as shown below.



We can use filters to narrow down on the type of operation we want to check. For instance we can choose to only see the 'write' operations performed.

Dynamic Malware Analysis Tools

It would not be wrong to say that every malware has its personality. Not that we want to start treating malwares like living things but the comparison is justified based on the different ways a malware behaves. To study a part of this dynamic behavior we will be using some tools

Autorun
This tool is used to check what is running at system. This helps in understanding if a malware has set itself to run at startup

Process Explorer
This tool can be used as an alternative to Task Manager as well as checking the processes, threads as well as DLLs curently loaded on the system


Process Monitor
This tool can be used to keep an eye on the events happening on the system. This tool monitors Registry, file level, network processes, thread changes happening on the system

ListDLL
Used to display DLLs loaded on the system

TCPView
Lists active TCP/UDP endpoints

WinObj
Shows windows object namespace

BinText
Can be used to extract text present ina a particular executable

RegShot
Allows us to take two snapshots of the system recording registry level changes between the two. These can then be compared with each other to understand the changes which were introduced once the malware ran

CaptureBat
Captures events happening on the system at the file, registry, processes and network level

HandleDiff
Detects changes to handle tables of processes

WireShark
Capture incoming as well as outgoing traffic from a particular machine

MalcodeAnalysisPack
Package which contains applications which have been proven useful for analysis purposes

Remnux
Lightweight Linux distro for assisting malware analysts in reverse engineering malicious software

This is not an exhaustive list, but these are some of the tools which would be used most frequently for the purpose of malware analysis. I will provide examples and detailed use for some of these tools shortly

Malware Analysis tools chest: ClamAV

ClamAV is not a tool for analyzing malwares per se, it is more of a tool for organizing and is mainly useful in the pre-analysis stages.

Many malwares are analyzed and studied on a daily basis by researchers, companies, hackers and the curious  kids of the present age after they finish their homework, sigh!  Its always challenging, fruitful, satisfying to analyze a new malware which has not been touched and studied by others. That gives a rush ! So before analysis, why not make sure that its not analyzed before ? Enter ClamAV ...

ClamAV is used for classification of malwares by many malware analysts. Its always advisable to put the executable through ClamAV to understand if someone has analyzed it. We can refer to the analysis to gain knowledge about the malware, compare our analysis with the other and thereby understand how potent our methods of analysis are.

Virtual Machines for Malware Analysis

An ideal setup for Malware Analysis would be to have a machine where we can readily install and execute malicious programs. But given the nature of malicious programs, they may cause permanent and irreversible damage to the machine. To protect a machine from such damage Virtual Machines are used.
A Virtual Machine is a OS running within an OS. Softwares like VMWare and VirtualBox allow emulation of multiple Operating Systems on a single physical system.

Advantages of using a Virtual System:

• Safe environment to infect: We can safely infect a virtual machine without harming the base system to some extent (more will be explained about this later). This allows us to boldly analyze dangerous malwares which we would otherwise hesitate to analyze.   
• Snapshots: A snapshot taken in a Virtual Machine saves the state of the virtual OS 'at that point of time'. In the event of a system crash due to the malware, we can travel back to the state when the snapshot was taken.
• Host-Only Networking:  This is convenient for interconnecting virtual systems using a simulated network without additional hardware. The host-only network allows any virtual system to see all traffic on the simulated network when listening in promiscuous mode.This makes monitoring the specimen's network interactions easy.
• Multiple environments: Using virtual machines for different OS allows us to perform analysis on different Operating Systems. It is more feasible for people to have multiple systems with different OS  rather than buying different systems with multiple OS. Malwares usually behave differently on different OS and different versions of the same OS. Having multiple OS allows us to analyze malware behavior on different systems and thus get a better understanding of the malware.