Malware Analysis Made Easy: Cloud Investigations

Key Takeaways

when you upload a suspicious file or even a malicious program like computer malware into those common and well-known Cloud sandbox analysis tools they don't always keep that a secret think of platforms like virus total and others they usually take what you upload and share it with other vendors or cyber security firms antivirus engines and maybe you don't want that perhaps that includes sensitive information that you don't want public and you would much rather have a private scan for files or programs and executables say you want to keep your analysis private so I would love to introduce you to malore by internet 2.0 and they say it's all about simple file analysis they want to simplify and streamline a lot of this reverse engineering and malware analysis with your privacy in mind if you'd like you can check out their website and yeah they have all those like corporate bougie business professional things that they say to make this pretty cool and attractive and worthwhile for folks finding it online but if You' seen them post on Twitter you know that they have a lot of fun with it too in this video I would love to show you some of the cool things that you can do with malor but hey before you freak out it is free you can get access to it you can work with all this stuff completely for free and I will be transparent here look internet 2.0 and malore is the sponsor of this video but you can access just about all this functionality completely for free so check it out here is a dashboard that you land in once you've registered and logged in to malor and look they have a smart scan button where we can apply any file that we might want to upload like we're working with any of those online Cloud analysis tools now smart scan is kind of an interesting thing here because there are a lot of different kinds of scans that malor can perform but honestly you don't need to have to care about all those you'd like it to be abstracted away and it'll rip through cut up do whatever it might do to dissect any kind of file and it should be able to smartly and automatically track that down and figure it out so I've selected a file that I could go ahead and upload and I will click press to start and it'll begin to upload this is pretty cool because you can see everything that'll automatically do as it's running you could also determine look this is a portable executable file so if you wanted to you could add some other scans like exif data y rules Dynamic analysis readable strings and more all right so the scan has finished and we have some results here and this is pretty cool you can see in the summary section there is a little bit of a risk breakdown 2.96% all right some file entropy randomness of the file that it was able to calculate here for us the higher the entropy the more likely it is that the program is encrypted or packed now it's on a scale of 1 to8 so we're at 7.5 just about it's a little bit sketch some suspicious assembly in the mix known malicious end points or exports from like win32 API functions that might have been pulled in like get proc address load Library Etc no signature on the binary and it would classify this as still malicious if we keep scrolling down we can see some of the other information like that exif metadata the file size comp compilation Tim stamp here and of course hashes for your classic indicators of compromise now if we go back to the top here though it does break down a couple more of the exports and imports I think this is pretty neat cuz it will give you all the address locations for imports that it's pulling in here the Yara section is even more cool but I want to save that for later we'll talk about that soon I do want to mention how this is a private sample submission you can see this little checkbox for whether or not it is public and it is unchecked right but if I toggle that on I get a link to share this sample and this analysis and Report with anyone that I might like but I have to acknowledge and share that link out with them I could copy that but I could just toggle that off and it's again a private sample not visible by anyone else now remember privacy focused malore doesn't list out or just offer an endpoint where you could see all of the latest public submissions it does offer a couple a little bit of a handful and we could dig into some of them if they're worthwhile and interesting and if anything I think this is really cool to showcase some of the other analysis that maloree might automatically do like code reuse here is just a simple calc.exe totally benign innocent and just fine Microsoft binary but they'll note hey we do see some similar code used in other applications and other binaries right I don't want to drag you through all of this assembly by any means but at least being able to find the instructions and see the code that is used in other malicious samples in some cases could be pretty handy for doing that threat in Ence and Analysis they have another example with a specific document file we could go dig into that one and I think this is neat here because it's actually showcasing more of a different kind of file like not an executable or portable. pexe right but a PowerPoint file they'll not it's like one of those Microsoft Office documents in some way and that gives you some of the Insight now I know this is just a summary page but take a look at some of these other tabs again I'm going to say Yara for later cuz I think that's the coolest thing but the DFI or that document file sort of analysis here it digs into ooh look we detected some macro logic those Auto enabled or often times autoopen code that can just run with a Microsoft Office document that might load other functionality from dlls looks like a handful of rules are firing that this has suspicious variables in the mix hey has a startup hook to make sure it auto runs and it's just overall pretty suspicious we already got a quick example of just a portable executable or an exe file but there is another worthwhile one I think we could showcase this Trojan exe which malor claimed look this is a threat it's a little bit sketch and if we get to dig into the risk breakdown here it actually tells us look some sketchy unknown sections like upx like a universal Packer right we've totally seen that before in other videos and other samples even like Capture the Flag challenges and the file entropy is way high just about eight that one is totally malicious and we can categorize that as a threat obviously trojans.com their Wiki right the FAQ frequently asked questions and you can get into stuff like for their API and that's pretty awesome using the malore API or the application programming interface this is pretty slick because you'll always automatically just have an API key and you can easily just toss files into it or do whatever analysis that you would like programmatically in any other way that you'd like it's worth noting by the way that they also even have an STK like some python bindings or some other languages we can go track that down and I believe it's over on their GitHub yeah look at this the malore SDK looks like it has some C bindings Java Python and if you wanted to dig into each of these honestly I believe it is just uh wrapping around the API calls that are just HTTP requests but if you wanted to take a look at some of the sources code you can see the API itself just a lot of functionality and convenience functions to be able to do what you would naturally do with the API on its own still I think having that capability with python is pretty cool the reason that I brought up that support and documentation though is because it tells you a couple other really cool interesting things like they have a web probe to be able to like look at new URLs or things that you might even browse to naturally with your web browser or maybe office Shield hey if you're getting any documents from email like Microsoft Outlook you could add in this capability this extension this genuine Outlook add in to be able to still analyze and do the detection on things that might come to you as attachments in email once the ad isn't installed you can grab a malore office Shield that will keep track of anything that you get through email so that way a lot of the common file formats things that you just might get over email like PDF files document files or whatever can be scanned and ha be taken care of by m core scrolling through here even more they have one capability that I think is pretty neat and it's literally a desktop agent so one program one tool one application that you can install on Windows like on your computer that will set up a directory or a file folder location on the system that you could use as a Dumping Ground for scans with malor they note that this is supplementary right it should not be some replacement for antivirus or EDR but one other piece of intelligence and Telemetry for you and you could go ahead and install this set up whatever place that you'd like and drop any files in there for it to be able to track and do some malor scans here they showcase just the simple example but using like oh a couple calculator copies we'll drop that in and we'll get to see the analysis already take place just automatically oh and there is one section how do I analyze scripts this one is interesting to me because I like a lot of those living off the land sort of you know natural scripting languages that are often times obfuscated like completely messed up lots of gibberish nonsense text to try to confuse the analyst or the security researcher maybe digging into that malare sample so I want to try this I want to upload some wild wacky jscript or Powershell or BB script or batch whatever and let me go see if I can start a smart scan on one of those kinds of files I think we had a big go loader sample that we were working through on stream at one point so let's see if malor can cut that up and while that is scanning let me say I think right now net binaries cannot be analyzed uh dynamic Al only statically but just about everything else is going through some Dynamic analysis on the back end and another note uh malor I believe does not yet unpack the files that you might offer so you won't be able to just give it like a zip file with infected still as the password and unravel it to be able to take apart all the layers and pieces and parts of the onion uh you might be able to use some other capabilities like unpack me others that we've showcase and just other tools in your toolkit remember it's meant to supplement some of your analysis and give you a little bit more more insight but not meant to be a silver bullet let me see if I can add the dynamic analysis in that case uh and any strings you can get Etc what else do we have here we have readable strings that might be able to pull out a ton of these and the dynamic analysis I'm curious what it will try to do this is like a 40 megabyte file of just plain Tech string so I'm curious all yeah it just it basically gets everything that's looking weird in here that at least Clues me in enough to know that's a sketch file and it should warrant some other analysis look at my vertical scroll bar right now pages of this yeah it's a good thing that's a private scan no one else gets to deal with that this is a cool part though cuz we could look for potential files maybe we could look for potential URLs could look for other IP addresses though or custom regular Expressions if there's anything specific that you wanted to search for I'll go look back at my other scans though now that I kind of realize hey we can add as many more of these as we want so even some of the older samples that we did we could just add in anything else we might like ooh okay so yeah code reuse browser extension even phone application analysis you could do this for like APK files I'm digging the URL check Ransom note comparison domain this is where all the good stuff is let me toggle these on so we can see them in action here and then take a look at some of the other Pro things you could do like yeah oh even generating snort rules parsing Android manifest files all right so this is the benefit of at least getting a little bit more granular and not just doing a smart scan right one other thing worth mentioning though is again hey taking a look at the API reports section things that might be submitted by you using the API and actually another one is actually through a Chrome extension that malore has this is another that I saw in the FAQ like their malore web probe which is really cool because it's a browser extension like Chrome or Firefox you could just install this extension and then it'll work with other URLs or different pages on the internet that you might browse to just naturally and still do the analysis like any other Cloud online analysis sandbox but super slick it can just do it automatically for you malore just as well has a tab for things that can be uploaded by the agent that Windows desktop application but honestly again I was kind of teasing this a little bit earlier but I think it's pretty cool when you actually dig into some of the analysis uh I didn't dig into that tab for Yara but that's one of the coolest sections in my mind because if we look at another one of those files another one of those samples it can automatically automatically sort of put together a Yara rule based off of all the things that it might have already detected and filtered narrow down specifically to the sample that you provided so hey tracking down yes this isn't executable hey yes this matches a couple strings or heximal instructions stuff that's done operations as part of that like the crisis ransomware which was the sample that I uploaded and that's pretty slick here's the all rule to detect that and now you can just use that wherever you would like and a bit of a thot view a little bit of a crash course and speedrun though but that is malore and I think it's really cool not going to lie since simple file analysis it's streamlining it's automating it trying to make it so that you can make better decisions as to what requires a little bit more analysis and a little bit more investigation malor is designed to help you be better informed to make decisions as to what you will pour more time and effort into and again it's free it's awesome hook into it with python hook into it with an API really really cool privacy focused private scans for files and intelligence thank you so much for watching hope you enjoyed this video again a little bit of a crash course showcase Safari of what malore can do if you're interested Link in the video description huge thanks to malor and internet 2.0 for sponsoring this video but seriously I love their stuff and they're fantastic and cool to hang out with on Twitter check them out see you in the next video everyone like comment subscribe until next time