• Home

  • Documents

  • Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools...
18
Malware Analysis Fundamentals - Files | Tools May 26, 2020 Marc Ochsenmeier @ochsenmeier www.winitor.com

Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

  • Upload
    others

  • View
    13

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | ToolsMay 26, 2020

Marc Ochsenmeier

@ochsenmeier

www.winitor.com

Page 2: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

2

Handling generic|unknown File

Page 3: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

3

Handling email File

Page 4: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

4

Handling RTF File

Page 5: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

5

Handling PDF file

Page 6: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

6

Handling LNK File

Page 7: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

7

Handling MS Office 97-2003 File

doc, xls, xlsm, xlsb, ppt, msg files

(I) xls, xlsm, xlsb files

Page 8: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

8

Handling protected MS Office 97-2003 File

doc, xls, xlsm, xlsb, ppt, msg files

(I) xls, xlsm, xlsb files

Page 9: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

9

Handling MS Office 2007+ File

docx, xlsx, xlsb, xlsm, pptx files

(I) xls, xlsm, xlsb files

Page 10: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

10

Handling protected MS Office 2007+ File

docx, xlsx, xlsb, xlsm, pptx files

(I) xls, xlsm, xlsb files

Page 11: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

11

Handling MSI File

Page 12: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

12

Handling Executable File

Page 13: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

13

Handling AutoIt Executable File

Page 14: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

14

Handling Certificate File

Page 15: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

15

Handling Cab File

Page 16: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

16

Handling Microsoft Office Files

Page 17: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

17

Handling miscellaneous Files

Page 18: Malware Analysis Fundamentals - Files | Tools€¦ · Malware Analysis Fundamentals - Files | Tools @ochsenmeier | Marc Ochsenmeier | May 26, 2020 8 Handling protected MS Office 97-2003

Malware Analysis Fundamentals - Files | Tools

@ochsenmeier | Marc Ochsenmeier | www.winitor.com May 26, 2020

18

• Oletoolshttps://github.com/decalage2/oletools

• Didier Stevenshttps://blog.didierstevens.com/didier-stevens-suite/

• Analyzing Malicious Documents Cheat Sheethttps://zeltser.com/media/docs/analyzing-malicious-document-files.pdf

• Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros) https://github.com/DissectMalware/XLMMacroDeobfuscator

• AutoIT Extractorhttps://gitlab.com/x0r19x91/autoit-extractor

• uncompyle2https://github.com/wibiti/uncompyle2

• LECmdhttps://f001.backblazeb2.com/file/EricZimmermanTools/LECmd.zip

More Information


Android Malware Exposed-Evolution of Android Malware

Android Malware Exposed-Evolution of Android Malware

Documents
Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Documents
Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Documents
Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Documents
Advanced malware analysis training session6 malware sandbox analysis

Advanced malware analysis training session6 malware sandbox analysis

Technology
Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Technology
Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Documents
The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Documents
Malware Fundamentals POLITEHNICA University of Bucharest 14 th of January 2015 Ionuţ – Daniel BARBU

Malware Fundamentals POLITEHNICA University of Bucharest 14 th of January 2015 Ionuţ – Daniel BARBU

Documents
GARDEN ROUTE CAMPUS€¦ · CompTIA Strata IT Fundamentals Security Fundamentals Security Concepts, Malware, Network Security, Secure Web use, Communications, Secure Data Management

GARDEN ROUTE CAMPUS€¦ · CompTIA Strata IT Fundamentals Security Fundamentals Security Concepts, Malware, Network Security, Secure Web use, Communications, Secure Data Management

Documents
MALWARE CAMPAIGN TARGETING LATAM AND SPANISH BANKS · Malware Campaign Targeting LATAM Spanish Banks MALWARE CAMPAIGN TARGETING LATAM AND SPANISH BANKS. 2 Malware Campaign Targeting

MALWARE CAMPAIGN TARGETING LATAM AND SPANISH BANKS · Malware Campaign Targeting LATAM Spanish Banks MALWARE CAMPAIGN TARGETING LATAM AND SPANISH BANKS. 2 Malware Campaign Targeting

Documents
Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Documents
Malware & Anti-Malware

Malware & Anti-Malware

Engineering
Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

Documents
An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Documents
Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Documents
Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Documents
Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Documents
Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Documents
BAC 2 - MHAN 1221 ENGLISH IDIOMS PART 2 E. Ochsenmeier 2020

BAC 2 - MHAN 1221 ENGLISH IDIOMS PART 2 E. Ochsenmeier 2020

Documents
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Technology
Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Documents
Evaluating Open Source Malware Sandboxes with Linux malware

Evaluating Open Source Malware Sandboxes with Linux malware

Documents
Malware Detection with Malware Images using …cosc.canterbury.ac.nz/research/reports/HonsReps/2018/...Malware Detection with Malware Images using Deep Learning Techniques by Ke HE

Malware Detection with Malware Images using …cosc.canterbury.ac.nz/research/reports/HonsReps/2018/...Malware Detection with Malware Images using Deep Learning Techniques by Ke HE

Documents
Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Documents
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 2 Malware and Social Engineering Attacks

Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 2 Malware and Social Engineering Attacks

Documents
Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Education