Hello.
In this video, let's take a look at malware analysis terminology.
These are some basic terminologies backed, obfuscated, disassemblers or decompilers debuggers, IOCs
and malware artifacts.
Packed packer.
A packed malware contains part of itself compressed or encrypted.
The stub will unpack this compressed part and then execute it, either by injecting it into another
process memory or runs its itself as a separate process.
So a packed malware consists of two parts the stub and the payload.
The payload is a part that is compressed and the stub is run first in order to uncompress the payload
into memory.
Obfuscation.
Obfuscation uses meaningless strings for variables so that it makes it difficult to understand the function
and purpose of variables.
It also means meaningless strings for function names.
So that the malware analysts would not know what the purpose of a function is.
Sometimes strings can also be encoded in base64.
Obfuscation can also involve taking a string and breaking up into small parts, and each part is substituted
by a function whose purpose is to be obfuscated during runtime.
And then those parts are then combined together concatenated to form the original string.
Examples of this technique is usually found in PowerShell or JavaScript or VBScript.
Malware executables or binaries can also be obfuscated or encrypted.
Disassemblers.
Are those tools used for disassembling a binary file into assembly code?
It is used for analyzing a file without executing it.
This technique is also known as static analysis.
Examples of Disassemblers are Ghidra and Ida Pro.
Ghidra is also known as a Decompiler because it can decompile a binary file into assembly as well as
C source code.
One disadvantage of disassemblers are that it cannot analyze memory region.
This is because the program is not running.
Therefore it is not loaded into memory.
Debuggers.
Debuggers are those tools which allow you to run programs and then step through it to analyze the program
as it is running, to analyze its instruction step by step.
Because debuggers are actually running the program, you are therefore able to examine memory in which
the program is loaded into.
This technique is also known as dynamic analysis.
Examples of debuggers are xdebug and windbg.
You can also use debuggers to unpack PAC malware by dumping memory after the PAC program has already
unpacked itself in memory.
Debuggers are also excellent tools to do behavior analysis.
That is, to run a program and see what it does.
IOCs.
IOCs stands for Indicators of Compromise.
This means that you can look for any of these inside your operating system, and if you find any of
these, then you can know for sure that your machine has been compromised.
That's why they are called indicators of compromise.
So examples of IOCs are file hashes.
File hashes can be obtained by using hash programs in order to obtain the MD5 or Sha for a particular
file.
You can then compile those hashes with existing hashes in order to identify the malware.
You can also look for file names.
Email addresses, URLs, drop files as well as added or modified registry keys.
So if you find any of these or combination of them in your operating system in your machine, then this
highly suggests that your machine could have been compromised.
Malware.
Artifacts.
Malware Artifacts.
Are those items left over from malware infection and they include indicators of compromise.
Thank you for watching.
I'll see you in the next one.