SSTIC 2014, Marion Marschalek, Malware Anti-Analysis Tricks

1. CATCH ME IF YOU CAN

2. HUNTER
HUNTED
and HAUNTED

3. YOUR HUNTER TODAY
Marion Marschalek

4. ANALYST
aims to detect
MALWARE
MALWARE
aims to detect
ANALYST

5. LEVELS of SOPHISTICATION
Mass
Sophisticated
Toolified
APT
aAPT
EPT
?
Malware
Malware
Malware
Malware
Malware
Malware

6. while some are not all that sophisticated ....

7. SIMULATION
DEBUGGING
VIRTUALIZATION
DISASSEMBLINGSTATIC ANALYSIS
ARTIFICIAL
INTELLIGENCE

8. SIMULATION
VIRTUALIZATION
STATIC ANALYSIS
DISASSEMBLING
DEBUGGING
ARTIFICIAL
INTELLIGENCE

9. SIMULATION
VIRTUALIZATION
STATIC ANALYSIS
DISASSEMBLING
DEBUGGING
ARTIFICIAL
INTELLIGENCE

10. SIMULATION
VIRTUALIZATION
STATIC ANALYSIS
DISASSEMBLING
DEBUGGING
ARTIFICIAL
INTELLIGENCE

11. SIMULATION
VIRTUALIZATION
STATIC ANALYSIS
DISASSEMBLING
DEBUGGING
ARTIFICIAL
INTELLIGENCE

12. SIMULATION
VIRTUALIZATION
STATIC ANALYSIS
DISASSEMBLING
DEBUGGING
ARTIFICIAL
INTELLIGENCE
...

13. SIMULATION
VIRTUALIZATION
STATIC ANALYSIS
DISASSEMBLING
DEBUGGING
ARTIFICIAL
INTELLIGENCE
RANDOMNESS

14. THE ANCIENT ART
OF BYPASSING
ANTI-ANALYSIS

15. PEBBeingDebugged Flag: IsDebuggerPresent()
PEBNtGlobalFlag, Heap Flags
DebugPort: CheckRemoteDebuggerPresent() /
NtQueryInformationProcess()
Debugger Interrupts
Timing Checks
SeDebugPrivilege
Parent Process
DebugObject: NtQueryObject()
Debugger Window
Debugger Process
Device Drivers
OllyDbg: Guard Pages
Software Breakpoint Detection
Hardware Breakpoint Detection
Patching Detection via Code Checksum Calculation
Encryption and Compression
Garbage Code and Code Permutation
Anti-Disassembly
Misdirection and Stopping Execution via Exceptions
Blocking Input
ThreadHideFromDebugger
Disabling Breakpoints
Unhandled Exception Filter
OllyDbg: OutputDebugString() Format String Bug
Process Injection
Debugger Blocker
TLS Callbacks
Stolen Bytes
API Redirection
Multi-Threaded Packers
Virtual Machines

16. THE AWESOMENESS COMPILATION
THE „ULTIMATE“ ANTI-DEBUGGING REFERENCE [Ferrie]
http://pferrie.host22.com/papers/antidebug.pdf
THE ART OF UNPACKING [Yason]
https://www.blackhat.com/presentations/bh-usa-07/Yason/Whitepaper/bh-usa-
07-yason-WP.pdf
SCIENTIFIC BUT NOT ACADEMICAL OVERVIEW OF MALWARE ANTI-DEBUGGING,
ANTI-DEBUGGING AND ANTI-VM TECHNIQUES [Branco, Barbosa, Neto]
http://research.dissect.pe/docs/blackhat2012-paper.pdf
VIRTUAL MACHINE DETECTION ENHANCED [Rin, EP_X0FF]
http://www.heise.de/security/downloads/07/1/1/8/3/5/5/9/vmde.pdf

17. AWESOMENESS
IMPLEMENTED

20. UPATRE
SMALL | NASTY | THORNY | standardmalwareofftheshelf
PAYLOAD
PACKERPROTECTION

21. ANTI-SIMULATION

22. WINDOW
CONFUSION
and implicit breakpoint detection

23. *WANNABE*
TIMING DEFENCE

24. CITADEL
IDA Stealth Bruteforcing
PEB!NtGlobalFlags Anti-debug r.e.d.a.c.t.e.d.
Let‘s start at the end .....

25. ...

27. WITH DEBUGGER
WITHOUT DEBUGGER

28. CVE-2014-1776
.html vshow.swf
cmmon.js
Heap Preparation
Timer Registration
Eval ( something)
Prepare ROP Chain
Corrupt Memory
Fill SoundObject with Shellcode
Invoke SoundObject.toString()

29. SNEAKY EXPLOIT
BEING SNEAKY

30. ...
DECODING
OF THE ACTUAL
EXPLOIT

31. ALMOST
WONDERFUL
wonderfl

33. MIUREF
Once upon a time ...
and it‘s packer

34. Visual Basic 6.0
Microsoft, 1998
Object-based / event-driven
Rapid Application Development
Replaced by VB .NET in 2002
End of support in 2008
VB6

35. VB6 IS
NOT
DEAD

36. NATIVE
CODE

37. PSEUDO
CODE

38. P-CODE
TRANSLATION
P-code mnemonics
interpreted
by msvbvm60.dll
handler13:
ExitProcHresult
...
handler14:
ExitProc
...
handler15:
ExitProcI2
...
... FC C8 13 76 ...

39. DYNAMIC
ANALYSIS

40. DECOMPILATION

41. ADVANCED
STATIC
ANALYSIS

42. DEBUGGING

43. DEBUGGING

45. EVER HEARD OF.. kernel33.dll ?

46. Dynamic
API
Loading
... Crap.

47. BACK TO STEALTH MODE

48. Ou lá lá...
x86 !
POST VB6 PACKER POST C++ PACKER

49. C++ PACKER VB6 PACKER

50. THANK YOU!
Marion Marschalek
marion@0x1338.at
0x1338.blogspot.co.at
@pinkflawd