Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service -...

Visual Analysis of Malware Behavior

October 11th, 2009

About Us

• University of Mannheim, Germany

• Laboratory for Dependable Distributed Systems• Security research:

• Analysis of malware and spam• Honeypots / IT-Forensics

Motivation

• Sandbox Service - CWSandbox.org

• Dynamic malware analysis • API-Hooking• Monitors 121 API-Calls out of 20 sections• Detailed Behavior Report (XML)

• Up to 4000 new samples per day• Manual processing not possible

Motivation

• What are the main Operations?• Network activities?• Registry access?• Filesystem operations? • ...

• Which operations do not occur?•

Motivation

• What are the main Operations?• Network activities?• Registry access?• Filesystem operations? • ...

• Which operations do not occur?•

Which samples are of interest?

Visualization

• CWSandbox report is “too” detailed• Use visualization for abstraction• Simple to create• Comprehensible

• Treemaps and Threadgraphs

• Static version (Python, matplotlib)• Dynamic version using JavaScript (flot, Jit)

Treemaps

• Quick overview• Displays the distribution of all operations• No information about the sequence of operations

• Use case: Malware clustering

Threadgraph

• Detailed view of the monitored behavior• Every monitored operation of all executed threads• Sequential order preserved

• Truncated Reports only (static version)• Zoom necessary (JavaScript)

Analysis of malicious PDFs

• Monitor Adobe Acrobat Reader within CWSandbox• Autoupdate disabled

• Short experiment:• 200 benign PDFs• 17 malicious PDFs

• Two different Treemaps• Malicious operations are observable at once

Conclusion

• First attempt on visualization - need Feedback• Plots are accessible on CWSandbox.org

• Static + JavaScript version

• Study on image clustering and classification• Development of further visualization types

Questions?

http://pi1.informatik.uni-mannheim.dehttp://cwsandbox.org

trinius@uni-mannheim.de

Visual Analysis of Malware Behavior - VizSec · 2020-06-03 · Motivation • Sandbox Service -...

Documents

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Official Malware Report - exploit-db.com · 8.1 This malware sample makes a function call to the native Windows API C:\WINDOWS\System32\winsock32.dll which is the Windows Sockets

Reversing malware analysis training part8 malware memory forensics

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware and Anti-Malware Seminar by Benny Czarny

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

DAVIX - VizSec 2008

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Visualizing Compiled Executables - VizSec · Visualizing Compiled Executables ... • “Ether: Malware Analysis via Hardware Virtualization Extensions” Dinaburg, Royal, Sharif,

Evaluating Open Source Malware Sandboxes with Linux malware

MAMADROID: Detecting Android Malware by Building Markov ... · Android malware detection. M AM DROID characterizes the transitions between different API calls performed by Android

Windows Malware Firewall: Remove Windows Malware Firewall

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Reversing malware analysis trainingpart9 advanced malware analysis

Code Cartographer's Diary - pnx.tf fileOverview: Malpedia Motivation & Overview Operationalizing Malpedia Windows API Usage Recovery & Analysis for Malware Characterization Tools:

MAS: Malware Analysis System Based on Hardware-Assisted ... · Recently, malware analysis methods which utilize virtualization technology are in-troduced such as Win32 API hooking,