RE: Malicious Code Analysis

["Peter Kruse" <kruse () krusesecurity dk>]

Hey,

> These were not submitted to any AV vendors since Norton did flag them. 
> In the past I have submitted unknown trojans/ viruses like these to 
> Symantec when clients have been owned, but what can I say they are 
> hardly 0day more like 300 day.

8-)
 
> http://www.bitsum.com/pec2.asp

Yes, I already have this tool in my box. Pretty useful for first glance.
 
> Could you share your methodology on how you go about reverse 
> engineering/ disassembling a malicious piece of code that has had a 
> packer ran on it?

There are many off-the self unpackers out there that will do the job just
fine, but lately malware writers rather modify or use enhanced/hacked
version of popular PE-packers. 

Either way, a compressed binary will have to uncompress itself using the
compressor stub in order to run. To unpack the code look for the call that
jumps from the stub to the unpacked code. When the jmp address is located
you should modify, so the jmp goes to esi. This will put the code in a loop.
Next up procdump.

There are plenty of good tutorials. One of these are associated with IDA:
http://www.datarescue.com/idabase/unpack_pe/

I hope this helps you getting started.

Regards
Peter Kruse


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/