Hello and welcome back.
In this video, we are going to do PE header and hash analysis.
So to start off, we will open FLARE utilities and run the PE Studio program.
We are now going to drop the unpacked version into PE Studio and wait for it to analyze.
While it is analyzing, you can see "wait" messages in part of some of the fields.
Now that it has finished analysis, let us go and take a look at some of the indicators of compromise.
And you see there are many level one.
First section is writable.
And then here, for reference, the strings stack is blacklisted.
There are 25 blacklisted strings, and so there are also five references here.
And VirusTotal has also detected this as a malware.
And it has for imports 18 of it at level one
blacklisted.
And also the file contains writable and executable sections,
one count of that.
And it also has self-modifying executable sections,
one count of that, and the file contains resource in a language that is tagged as blacklist—Russian
language.
So we'll take a look at all these now, one by one, starting with this optional header.
So under Optional Header, you will see that the subsystem is a GUI.
Therefore, it can run—it can integrate with the GUI system.
And that ties in with our earlier analysis where we saw some JavaScript code to show a fake warning
about your system being infected with spyware and adware.
Now under the File Header here, you can see the compiler stamp.
This program was compiled on May 7th,
but in the year 2007.
And if you go to the Resource section under here, Dialogue, you can see the language is Russian.
So another indication it could be Russian in origin.
And if you go to the
Sections here,
you can see there are—
the .text section, which is supposed to be the code section,
it is writable.
Now, that is a red flag because code section is supposed to be executable and readable, not writable,
and it is also self-modifying.
So this could be indication that the malware could be performing self-modification as it is running.
And then under the Libraries, you can see the IAT table.
So this looks quite normal.
There are a lot of exports.
This is because we have unpacked it—we have unpacked it.
For the packed version,
if we were to analyze the packed version, you will find that a lot of the imports are not—
it's not there.
So very few functions imported
indicates that it is packed.
But we have already unpacked it.
That's why we see all this—
quite a number of functions.
Let's look at the Imports.
So let's list it according to Blacklist.
And here we find RegSetValue, indication of persistence.
It is trying to persist itself through making a registry using this API to create a new key.
And we also see it's got the ability—it is able to connect to the Internet. WSAStartup is the initialization function
for Winsock, and here are also the Windows networking functions being used to perform actions to get
things ready for connecting to the Internet.
It can also execute other programs with the exec API for executing other processes.
Okay.
So now let's take a look at the—so these are quite a number of indicators of compromise.
And now let's do a hash analysis.
So we'll first start off with the packed version. Right-click,
and then here we have Hash My Files.
And you can copy the MD5 here and open the VirusTotal in Chrome and see the VirusTotal report.
Click on the Search tab, and then paste your MD5 hash and hit Enter.
And you see 60 out of 71 antiviruses have detected the type of virus it is.
Trojan.
Trojan, FakeAlert, and so on.
So this confirms that this indeed is a virus.
So that concludes our static analysis for this malware,
sample two.
Thank you for watching.
I'll see you in the next one.