Windows PE files Infections and Heuristic Detection Nicolas BRULEZ / Digital River PACSEC '04

Introduction

Evolution of Computer Viruses Not Encrypted Encrypted Oligomorphic Polymorphic Metamorphic

PE File Format MZ Header Le PE Header Le PE File Header Le PE optional Header Le Data Directory Les Sections Headers

Position Independant Code Virus needs to be executable at any memory addresses. Calcul of a Delta Offset

Windows PE Files Infections Techniques

Virus Position Last Section: - New Section BEFORE : AFTER :

Virus Position Last Section: - New Section

Virus Position Last Section: - Last Section Expansion BEFORE: AFTER:

Virus Position Last Section: - Last Section Expansion

Virus Position Header Infection

Virus Position Cavity BEFORE:AFTER:

Entry Point Position In the Last Section

Entry Point Position In the First Section

Entry Point Position Before the First Section

e_lfanew Infection e_lfanew is a pointer to the PE Header Offset. You can find it at MZ+3Ch in the MZ HEADER. Infection by modification of e_lfanew is really straightforward. The virus is copied to the end of the file, but it doesn't need to have independant position code.

e_lfanew Infection Program is modified so its e_lfanew points to the Virus' PE header. Windows will therefore load the virus rather than the infected file. The virus will then make a temporary copy of the infected program and patch back the original pointer to PE header. The virus will finally run the temp file using CreateProcessA for example and will delete the temp file when this one ends.

Heuristic Detections on Windows PE Files

PE Structure Analysis Heuristic Detections are mainly based on the PE File Structure Analysis of Windows Executables. Entry Point Sections Characteristiques Sections names (with specific Characteristics) Values not Updated in the PE HEADER. Position of the PE HEADER in the file etc

PE Structure Analysis Entry Point in the Last Section Entry Point before the First Section

PE Structure Analysis Sections Characteristics : -Last Section « Executable » -First Section « Writeable » Section names AND their Characteristics

PE Structure Analysis « SizeOfImage » incorrect in the PE Header PE Header near the end of the File « Size of Code » incorrect

Code Analysis Non Standard Instruction at the Entry Point Calcul of a Delta Offset Suspicious Code Redirection: -JUMP FAR -PUSH RET etc..

Code Analysis Code Looking for PE Files Usage of PEB to gain system dlls Image Base Hardcoded value of systems important datas (PEB...)

Code Analysis Suspicious Strings Inside Code Sections. - "*.exe" - Name of Win Functions: FindFirstFileA, MapViewOfFile etc.. - Registry Keys : Run / RunOnce etc.

Emulation JMP FAR PUSH / RET + Various ways to redirect code flow Decryptors Emulation ( Identification of loops)

Anti Heuristic Techniques

PE Structure Non Modification of Sections Characteristics More than one section added (fake reloc / imports) Part of code section overwriting to avoid suspicion. Packing of code section to place the virus is freed place EPO: Entry Point Obscuring

Structure PE FF15/FF25 (call IAT slots) Patches Stack Frame Patches Updated Checksums Existing Sections are renamed (when possible) « Size of Code » Fixed

Anti Emulation SEH - Structured Exception Handling. Co-Processor Instructions MMX / SSE Technology Undocumented Instructions Anti Virtual Machine Code Decryption Layers with Brute Forcing of Keys Threads

Anti Heuristic Code Delta Offset is calculated differently Usage of Obfuscation to hide suspect actions. (PE files checking etc) No more strings in the virus loader: CRC / HASH

Presentation of a Basic Heuristic Engine

Presentation of a Basic Engine Standard Binaries : notepad, regedit, calc, MS Pain, WordPad etc…

Presentation of a Basic Engine

Analysis of infected Binaries : Polymorphic, Crypted, Standard, EPO etc

Presentation of a Basic Engine

Notes: Although, this is a basic engine, it detected heuristically every viruses generated with a very recent Win32 Virus Generator. (VCL32).

Presentation of a Basic Engine Analyse of Packed Files : PE protect, PEShield etc…

Presentation of a Basic Engine

Live Disassembly Demo

Live Demo New Worm infected by a new Virus and PE packed. Live Disassembly of a real virus. This virus is very recent, and is not detected by most Anti Virus vendors as im writing those slides.

Conclusion

Any Questions ? Nicolas BRULEZ / Digital River PACSEC '04