As mentioned before, this malware consists of two components a portable executable file sparkcontext
and the Windows driver file Aacae dot size.
So when more than one malicious file is found on a computer, it's quite common that one of them generates
others.
So as spark that Excel can be executed by just double clicking on it.
While our courses must be loaded by another component such as the Windows Service Control Manager.
So with another driver.
So we can initially assume that spark that was executed and then it dropped the our courses to the disk.
In fact, during our static analysis of the imports, we noticed that the spark that has APIs to deal
with the Windows Service control manager.
And what we're going to do here is we're going to get the spark that switches to.
Jadra and we have the portable executable, something like that, and we imported it.
So we'll double click on it to analyze.
And after that click on Yes and analyze.
That's it.
So it's quite simple and small file simple because as you can see, it's already analyzed here.
So.
What are we going to do is we're going to go two bites here.
This bites.
We will display the bites here and.
Here we have the start.
Here I will note that on the screen.
Or instead we have the notepad.
Right.
Or sticky notes?
Yes.
So.
Not now.
Okay, so here our start is 000001.
Zero zero.
And zero zero here again and end this here.
I'm talking about this start at end.
We will note that.
And here our end is f f, f f f.
Let's actually make it uppercase f, f, f, f, f and f f.
Right.
So.
Why I noted this farce.
You will understand right now because here.
The.
This file starts with this pattern.
Right.
Let's actually.
Get this at the top here.
This is the top of the file that starts.
So here, this files this file starts with this pattern.
So we will also notify that start pattern.
Note that here the 45, a 90 and zero zero and so on here and others.
So here.
As you see, this is our standard pattern.
And the starting bytes are also used as the signature of files.
So these signatures are also known as magic numbers or magic bytes.
So in this case, the signature indicates that this file is portable executable, which is the file
format for executables, object code, DLLs and others used in 32 bit and 64 bit versions of Windows
Operating Systems.
So you will see this pattern every portable executable files object code dlls.
You analyze on the reverse engineering operations.
So here let's actually use our executable file.
It's already analyzed, but we can check that.
We have our key with us.
We also have the.
POS malware.
So here, as you can see in POS malware, our bytes also starts with the 45, a 90 and zero zero.
So you will see this pattern very common in the executable files object code, DLLs and others used
in 32 bit and 64 bit versions of Windows Operating Systems.
So we will.
We can also just close this post malware, but it can stay it here.
Now.
Okay.
So we can also calculate the difference between the start address and the end address.
And in order to do that, we will open the go to search or.
Window.
We will go to the window and go.
We will select the python from it.
Python.
And here what we're going to do is reset in Python.
We will subtract this here, subtract this here, in this case, Hex.
Hex.
Zero six.
Go to here.
Here.
And now we will go back to Python.
So we will calculate this, right?
So 00010000
-0 00151 and F so that close this preset's now here as input.
I'm sorry.
We need to add zero X here and here.
This is our output.
So 0X51 and five.
So then we can open the.
It's actually close this.
So we will we can open the spark that XM and look for the file by clicking on the search and memory
here.
And we will paste this code here that we got from this.
Search pattern.
So we will paste this.
The search pattern.
And here this is it.
And you will see here.
We have.
Let's search all.
So you will see the two occurrences of this header header pattern.
So the first one corresponds to the.
The header of the file we are analyzing in this case, it's sparked at XM, while the second one corresponds
to the embedded dot S is s, which is we just analyze here.
So.
Here.
This is that zero zero label.
It also has labels, but we have the image loss heater here.
Yes.
So as we know that it starts with the 004F here, location here.
So we will note that down.
Oops, that's not a good marker here.
So we already know that it starts with the actually, let's actually, instead of writing things here,
let's note it down so we can read it.
So location of that that 004.
F68 50.
Six 850.
As we noted it down and.
After that.
We will select the bytes here.
Search.
Or.
Yeah.
Now select here and select the bytes here.
So here we will enter the length.
Right.
The length is we got this, the calculation here and here.
We selected our bytes.
So by right clicking on the selected bytes and choosing extract and import right here, extract and
import, which is also available, it also has the shortcut.
So we get this screen where a data file is added to the project containing the selected bytes.
So so we identifying the malware components here.
Now let's actually we can also analyze it.
But here.
That's it.
And here in imports.
IBM's Notes program file.
And here we also have the in data type manager.
We have three data types spark data.
Here we have this data data file.
And we have the program trees here.
We can refresh it and so on.
So.
We can go to the active projects that excel here.
Program change symbol three.
At CES.
And here we.
We have this, we can see the spark that exit data here separately and that's it.
We have found the.
This, Aki.
That size file from our executable file.
Right.
And here we have this in the Ghidra active project.
Here we can see this, all the malware components.
Now, in next lecture, we will analyze the malware from the entry point of the program.
See you in next lecture.