# Malware

{% embed url="https://remnux.org/" %}

{% embed url="https://docs.remnux.org/install-distro/get-virtual-appliance" %}

{% embed url="https://www.youtube.com/watch?v=O5QQqR2-O28" %}



**AnyRun**\
Per the site, "Analyze a network, file, module, and the registry activity. Interact with the OS directly from a browser. See the feedback from your actions immediately".

{% embed url="https://app.any.run/" %}

**Hybrid Analysis**\
This is a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology.

{% embed url="https://www.hybrid-analysis.com/" %}

**Joe Sandbox**\
Live Interaction, URL Analysis & AI based Phishing Detection, Yara and Sigma rules support, MITRE ATT\&CK matrix, AI based malware detection, Mail Monitor, Threat Hunting & Intelligence, Automated User Behavior, Dynamic VBA/JS/JAR instrumentation, Execution Graphs, Localized Internet Anonymization and many more

{% embed url="https://www.joesecurity.org/" %}

##

## &#x20;                                 Malware Samples:&#x20;

Malware - Start from entry point and understand:

* What, why being performed
* Other ways to perform the same behavior
* look at ReactOS and reverse the API being used: [https://reactos.org/](https://reactos.org/)

{% embed url="https://www.ncsc.gov.uk/section/keep-up-to-date/malware-analysis-reports" %}

{% embed url="https://vx-underground.org/" %}

{% embed url="https://github.com/blackmassgroup/vx_underground" %}

{% embed url="https://samples.vx-underground.org/samples/Families/" %}

{% embed url="https://github.com/yatt-ze/The-Collection/tree/master/Rats" %}

{% embed url="https://github.com/Princekin/malware-database" %}



## &#x20;                                                Tools

{% embed url="https://www.wireshark.org/download.html" %}

{% embed url="https://mh-nexus.de/en/hxd/" %}

{% embed url="http://implbits.com/products/hashtab/" %}

{% embed url="https://www.aldeid.com/wiki/PEiD" %}

{% embed url="https://hex-rays.com/ida-free/" %}

{% embed url="http://www.pe-explorer.com/" %}

{% embed url="https://learn.microsoft.com/en-us/sysinternals/downloads/procmon" %}



## &#x20;      Analyzing Malicious Microsoft Office Macros

Current APT campaigns infect users by sending seemingly legitimate documents attached to emails i.e. an invoice for business. However, once opened, execute malicious code without the user knowing. This malicious code is often used in what's known as a "dropper attack", where additional malicious programs are downloaded onto the host. Looks perfectly okay, right? Well in actual fact, this word document has just downloaded a ransomware file from a malicious IP address in the background, with not much more than this snippet of code.

Thankfully Anti-Viruses these days are pretty reliable on picking up that sort of activity when it is left in plaintext. The following example uses two-stages to execute an obfuscated payload code.

1. The macro starts once edit permissions ("Enable Edit" or "Enable Content")have enabled edit mode on the Word document
2. The macro executes the payload stored in the text within the document. You need a large amount of text to be contained within the page, users will be suspicious and not proceed with editing the document. The macro doesn't need the text to be visible to the user, it just needs to exist on the page.



## &#x20;                        Analyzing Malicious PDF's

PDF's are capable of containing many more types of code that can be executed without the user's knowledge. This includes:

* JavaScript
* Python
* Executables
* Powershell Shellcode

Identifying JavaScript embedded PDF:&#x20;

We'll be using peepdf to begin a precursory analysis of a PDF file to determine the presence of Javascript. If there is, we will extract this Javascript code (without executing it) for our inspection.&#x20;

{% embed url="https://eternal-todo.com/tools/peepdf-pdf-analysis-tool" %}

```
$ peepdf
$ peepdf suspdf.pdf
```

To extract this Javascript, we can use peepdf's "extract" module. The following command will create a script file for peepdf to use:

```
$ echo 'extract js > javascript-from-suspdf.pdf' > extracted_javascript.txt
$ ls
$ cat extracted_javascript.txt
```

The script will extract all javascript via extract js and pipe > the contents into "javascript-from-demo\_notsuspicious.pdf" We now need to tell peepdf the name of the script (extracted\_javascript.txt) and the PDF file that we want to extract from (demo\_notsuspicious.pdf):

```
$ peepdf -s extracted_javascript.txt suspdf.pdf
```

Remembering that the Javascript will output into a file called "javascript-from-demo\_nonsuspicious.pdf" because of our script. You will see an output, in this case, a file named "javascript-from-demo\_notsuspicious" (highlighted in yellow). This file now contains our extracted Javascript, we can simply cat this to see the contents.

```
$ cat javascript-from-suspdf.pdf
```



## &#x20;                  Identifying .exe embedded in PDF

PDF attachments can be ZIP files or images

**HEX editor (HXD):** \
[https://mh-nexus.de/en/hxd/](https://mh-nexus.de/en/hxd/)

* 4D 5A MZ = .exe file

This tells us that when the PDF is opened, the user will be asked to save an attachment:

```
Javascript$ this.exportDataObject({
```

Let's investigate further by looking at the strings for attacker's IP and port

```
$ strings dodgypdf.pdf > dodgypdf.txt
```



## &#x20;            Identifying if .exe are obfuscated / packed

1. CHECK FOR PACKED: If its not a well know packer then google for more infomation

{% embed url="https://www.aldeid.com/wiki/PEiD" %}

2. CHECK IMPORTS: After confirming that this file is indeed packed, let's open it up with a tool called IDA Freeware.&#x20;

{% embed url="https://hex-rays.com/ida-free/" %}

3. CHECK HEADERS / IMPORTS / STRINGS: View - Imports, Tools - Disassembler

{% embed url="http://www.pe-explorer.com/" %}

4. CHECK STRINGS: Open a Command prompt on the Windows Machine and navigate to the directory "Tools\Sysinternalssuite"

{% embed url="https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite" %}

```
$cd C:\Users\Analysis\Desktop\Tools\SysinternalsSuite
$dir
```

We're going to use Microsoft's Sysinternals "Strings" program to output the retained strings within the specified file

```
$strings "C:\Users\Analysis\Desktop\pathtofile"
```



**BOOKS**

Computer systems: a programmers perspective \
https://www.amazon.com/Computer-Systems-Programmers-Perspective-3rd/dp/013409266X



**COURSES**

ARCH1001 OST2 \
https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Arch1001\_x86-64\_Asm+2021\_v1/course/

Compiler explore \
https://godbolt.org/

Indirect Syscalls and callstack spoofing: \
https://github.com/HavocFramework/Havoc/tree/dev/payloads/Demon/src/asm

Debugging with WinDbg Preview/x64dbg (Debuggers 1011 OST2) \
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/

{% embed url="https://maldevacademy.com" %}

{% embed url="https://www.youtube.com/watch?v=L9SI-PZ8-j8&embeds_referring_euri=https%3A%2F%2Fcdn.iframe.ly%2F&feature=emb_imp_woyt" %}



## &#x20;   ☠️Injecting PowerShell scripts into PDF files ☠️

To attach the script as a separate file to the PDF:

1. use the Attach File feature in Adobe Acrobat
2. open the PDF document in the editor
3. select the location where you want to attach the file
4. then use the Attach File feature to add the PowerShell script file

To attach a PowerShell script to a PDF and have it execute automatically when the PDF is opened, you can use a third-party tool such as Adobe Acrobat Pro to create a PDF with an embedded script. Here are the steps to do this:

1. Open Adobe Acrobat Pro.
2. Click on "Tools" in the top menu bar.
3. Select "Prepare Form" from the drop-down menu.
4. Click on "Add New Field" in the right-hand pane.
5. Select "Text Field" from the options.
6. Click and drag to create a text field on the PDF document.
7. Right-click on the text field and select "Properties".
8. In the "Options" tab, select "Multi-line" and "Scroll long text".
9. In the "Actions" tab, select "Run a JavaScript" from the "Select Action" drop-down menu.
10. Click on "Add" to create a new JavaScript action.
11. In the "JavaScript Editor" window, type the following code to execute the PowerShell script:

```javascript
    var cmd = "powershell.exe -ExecutionPolicy Bypass -File "C:\\path\\to\\myscript.ps1";
    var shell = new ActiveXObject("WScript.Shell");
    shell.Run(cmd, 0);
```

Replace "C:\path\to\myscript.ps1" with the actual path to your PowerShell script file.

12. Click on "OK" to close the "JavaScript Editor" window.
13. Click on "Close" to close the "Text Field Properties" window.
14. Save the PDF document.

