1. Malware Analysis Jaimin Shah & Krunal Patel Vishal Patel & Shreyas Patel Georgia Institute of Technology School of Electrical and Computer Engineering

2. Objectives Analyzing a worm or a virus Provide a method to eliminate How to prevent from infection in future?

3. Overview Introduction Definition of Malware Definition of MalwareTechniques Lab Scenario Hands-on analysis of Beagle.J Hands-on analysis of Beagle.J

4. Introduction to Malware How? Forms of Malware Detection Techniques

5. Forms of Malware VirusTrojansWormsSpywareAdware

6. Detection Techniques Integrity Checking Static Anti-Virus (AV) Scanners Signature-based Signature-basedStrings Regular expressions Static behavior analyzer Static behavior analyzer Dynamic Anti-Virus Scanners Behavior Monitors Behavior Monitors

7. Malware Analysis Techniques VMWare Multiple Operating System Multiple Operating System Creates network between host and guest systems Creates network between host and guest systems Self-contained files Self-contained files Can transfer virtual machines to other PCs.vmx – configuration file.vmdk – image of hard disk

8. Lab Scenario Static Analysis BinText BinText Extracts strings from code IDA Pro IDA ProDissembler USD 399/user UPX UPX UPX compression/decompression

9. BinText Extracts strings from executables Reveals clues: IRC Commands, SMTP commands, registry keys IRC Commands, SMTP commands, registry keys

10. IDA Pro Disassembles executables into assembly instructions Easy-to-use interface Separates subroutines, creates variable names, color- coded Separates subroutines, creates variable names, color- coded

11. UPX Decompression Executable packer commonly used by virus writers Can compress wide range of files Windows PE executables, DOS executables, DOS COM files, and many more Windows PE executables, DOS executables, DOS COM files, and many more To unpack: upx.exe -d -o dest.exe source.exe upx.exe -d -o dest.exe source.exe

12. Decompressed Output

13. Process Observation Tools Process Explorer Monitor processes Monitor processesFileMon Monitor file operations Monitor file operationsRegMon Monitor operations on registry Monitor operations on registryRegshot Take snapshot of registry and filesProcDump Dump code from memory

14. Beagle.J Capabilities Registry/Run on startup Copies into folders containing “shared” Sends copies by email Backdoor

15. Conclusion As you have seen there are various ways for an attacker to get malicious code to execute on remote computers We have only scratched on the surface, there are much more to learn and discover

16. Questions ? References Images Images http://www.microsoft.com http://www.symantec.com Softwares Softwares BinText – http://www.foundstone.com http://www.foundstone.com IDA Pro – http://www.datarescue.com http://www.datarescue.com UPX – http://upx.sourgeforce.net http://upx.sourgeforce.net