Hello and welcome back.
Now we are going to perform embedded strings analysis.
To start off, we will open FLARE utilities and use the BinText.
BinText is already on the desktop, so we can just double-click on it.
So we use the unpacked version.
And run it in BinText.
The first thing we see is the DOS header.
"This program cannot be run in DOS mode," confirming that this is a PE file.
Let's scroll down and see if there are any other interesting things.
We also see that this is compiled with Visual C++ runtime program.
We see some registry strings here.
So probably this is for persistence, especially this one, RegSetValue.
And we see something interesting here.
From here to here, it seems like an HTML code, and you can see there's some JavaScript involved as well.
And here it seems like some kind of message that is going to show the user, "Your computer is in danger.
Windows Security Center has detected malware or spyware
infection.
It is strongly recommended to use special anti-spyware tools to prevent data loss."
So it is trying to—it's giving a fake error message.
And then here, this seems to be a kind of GET request to download something from this website,
downloadantivirus3.com, and from the name of it, probably trying to fool the user to download a
fake antivirus after scaring the user with a false message.
And you can see here it's trying to download something.
And this is the website.
And then down here we see some kind of registry.
And then
it also—it seems to be a string indicating some file-like extension, which brings to mind probably
a fake license file, like could be license.txt.
And here is probably the way the malware is trying to create persistence so that it can start again
when the user logs off, logs in, or reboots the computer.
And here we see the name of a file, xpupdate.exe.
This could be the file dropped by the malware.
And this probably is the file that this Run here is going to run.
So we can confirm that in the dynamic analysis later,
but good to know what to look for.
So we can probably make a note here on the files that we have seen.
So xpupdate is the file to account for
in the location. It seems to be a protected path,
C:\Windows.
Now, normally malware cannot write to C:\Windows without elevated privileges.
So when we run this malware later in the dynamic analysis, we might need to run it as administrator
so that it can perform this dropping of this file in this location.
Okay, so that's it for the strings analysis.
Now let's see if there are any encrypted strings. To search for encrypted strings,
you can use XORSearch. So XORSearch will search for any strings and brute-force it to try to decrypt it.
So XORSearch—this is how you run XORSearch.
If you run it without any parameters, it will show the help file.
And then for XORSearch, we can do it like this: the name of the unpacked file, and then the string that
you are looking for, probably HTTP.
So the first parameter is the name of the malware.
In this case, we are using the unpacked version.
Second parameter is the string you are looking for.
So it will now search for this string, and then it will brute-force some of the encryption keys to see
if it can find a string containing HTTP.
So let's press Enter.
And you see there's some hits.
And the first line shows it has found, using the encryption key of 00,
it has found the string.
So encryption key of 00 means there is no encryption,
so we can ignore this one.
Encryption of 20 means it's just a conversion from lowercase to uppercase.
So we can also ignore this one.
So it doesn't seem to be any encrypted strings in this containing HTTP.
We can try with this. Use the search for this, because sometimes malware will pack some files, will
encrypt some files containing certain PE files.
And if you are looking for this, and you know that this is part of the string in the header saying "This
program cannot be run in DOS mode,"
so that's why we are trying to search for this string to see whether there are any encrypted
strings containing this.
So press Enter.
And so far we only found one hit,
but this one's encryption key is 00.
That means this is not encrypted at all.
So this is also not encrypted strings.
So it seems from the XORSearch and the two most common things that we're going to search for—HTTP and
this—it doesn't seem to have any encrypted strings embedded inside it.
So that concludes the embedded strings analysis.
I'll see you in the next one to continue with the rest of the static analysis.
Thank you for watching.