Original subtitles

1

Hello and welcome to Obfuscation lesson

2

Malware authors use obfuscation to obscure meaningful information in the binary making it hard to analyze.

3

It aims to keep the malware code safe from security analysts.

4

using obfuscation techniques makes analysis and reverse engineering much more difficult

5

if security experts can't analyze the code, it means the malware stays fully undetectable or cero day, then antivirus cannot detect this threat

6

Obfuscation Techniques. Encoders: it uses simple algorithms, are easy to implement and barely take something from system resources.

7

Among the best-known encoders we have: base64, Caesar, and xor.

8

Cryptors: modify the binary information to make it unreadable without a secret key.

9

will be seeing encryption in ransomware section

10

Packers: use compression algorithms to obfuscate the executable’s content. The difference between encryption and packing is

11

that the former is meant to secure the binary data, the latter just obscure it.

12

Among the best-known packers we have: UPX, Themida, Enigma Protector, and more.

13

so on this lesson will be packing and unpacking using upx.

14

so, what we have here is two binaries, one packed and other unpacked.

15

we're using Total aware three, which is a keylogger, for now we just need the executable.

16

but you'll have access to source code and complete explanation on this malware later on the correspondent section.

17

ok, lets open this packed malware and se how it looks in cff explorer

18

ok, we can't see the file info, instead puts UPX, is clearly indicating this binary has been packed with UPX tool

19

go, check other sections, it puts upx and upx

20

now, this is important, lets checked the import directory

21

once you are familiarized with windows portable executable structure you will notice there's something wrong here

22

Why?, because is not conceivable that a binary consumes just these few windows apis

23

specially in the popular user32dll and kernel32dll.

24

for a binary to succeed, this dlls should be populated with a lot more apis.

25

this way even if you don't check any other section or use other tool, if you have acces to import directory and it looks like this

26

you can tell for sure this binary is holding information, highly probable is packed.

27

lets, see the contrast right now on an unpacked binary

28

then, using cff explorer lets open the same binary but unpacked

29

for starters, now we can see the file info

30

at the other sections there's no sign of upx packer

31

and most important import directory now shows these apis

32

we can see kernel32 is now full of typical apis like: get thread, get process, handlers managers and so on.

33

go see user32.dll, and check this out, now we have these apis,

34

and this getkeystate is clear indicator this is a keylogger

35

this api makes a polling of the state of the keyboard and is very common in keyloggers to steal keystrokes.

36

now, lets check the code out

37

this is totalaware3 source code, here we'll find the apis we just saw in cff explorer, find windows, show window and getkeystate

38

later will see this code in detail in keylogger section

39

now, lets run Ida pro free version, Ida is by much the most popular debugger

40

a debugger is a program to disassemble a piece of software code, run in as administrator

41

Your Ida may look a little bit different, but are essentially the same options, you may follow this without problem.

42

lets load our packed totalaware3

43

is a portable executable, so ok.

44

this is the first sign this binary is packed, it puts there's some problem with our imports.

45

in this left column we can see ida is telling us this binary was packed using upx.

46

this bar here normaly is a rainbow of colors, because Ida asign a color to each section in the binary.

47

but, since this malware is packed we get here only grey and black.

48

now, as we did in cff explorer lets check the imports

49

and as in cff explorer we get only a few apis

50

ok now lets open our unpacked malware for comparison.

51

don't forget run Ida as administrator

52

and open totalaware3 unpacked

53

just ignore this, click yes

54

maybe you noticed we didn't get the import problem message

55

and on left column don't puts upx any more

56

as I told you before this bar is populated with a rainbow of colors,

57

this time Ida have no problem on color coding each section on the binary.

58

lets now see the imports

59

this looks great, now we have a lot of apis

60

lets see

61

and as we saw earlier, this getkeystate is most likely telling us this is a keylogger.

62

ok now I just put this imports side by side, so you can tell the difference, left packed, right unpacked.

63

if you scroll down what you see here is our binary assembly code

64

Ida is an amazing tool, specially if you are interested in reverse engineering.

65

the learning curve is kind a steep, but if you decide give it a try, there're tons of info on the internet.

66

good news is that even if you don't master assembly language you still can use Ida and its many features to inspect your binaries,

67

like we just did it

68

ok, now lets unpack our binary using upx tool

69

So I'm coping our packed binary next to the upx tool executable

70

there we go

71

as you can appreciate here, the syntaxes to pack and unpack is very easy

72

and now this binary is unpacked

73

now lets see if everything was fine with our unpacked procces.

74

this looks very well, no upx traces.

75

now lets open it in Ida

76

there we go

77

and also looks great, we have our rainbow and no upx traces

78

lets see our imports

79

and as you see are just fine.

80

now we can tell our unpack process was successful.

81

thanks for watching, on next lesson we'll start Dynamic Analysis.