Tuesday, September 20, 2016

QuickSand.io In Depth - Part 2 The Reports

QuickSand.io Reports

Today we're going to dig deeper into the QuickSand.io document malware analysis reporting, and how the analyst can dig deeper into the results and extracted executables.



Header

The report header contains the information you'd expect - analysis time (for the submitted times you'll have to look at the submissions json page). File hashes. is_malware: 0 for clean, 1 for suspicious active content, 2 for exploits and embedded executables. Score - each yara rule for exploits or active content adds to the score. Runtime - it's fast. And the yara hits - exploits - CVE #, executables windows/mac/VB and whether a PE header is found, and general - the trojan signatures from Malware Tracker.


QuickSand.io Report Header

Streams

The streams section of the report is where you can did deeper into the content and cryptanalysis results. Clicking the headers expands the sections and the indentation shows the object relationships. Grey title are less interesting, red have exploits, and brown have executables.

The distribution item in the root can be very useful. The X's indicate the part of the file where an embedded executable exists. 0 is for null sections, F is for FF sections, 1 is for high entropy areas, and A is for ascii sections such as most of an RTF file.

We are also working on a structural hash structhash of the file which can help find samples from the same attacker or exploit kit.


QuickSand.io Streams section

DOCX Files

For docx files you'll see the hierarchy of files within the zip,  and embedded OLE files or high entropy data is analyzed for embedded executables as well.





Macros and No Embedded exe's

A lot of the new macro malware won't have an embedded exe, using the distribution results below, we   can see the file is mostly null blocks "0" and does not have enough entropy to have a built in EXE.


XOR

The XOR section shows the xorkey for cryptanalysis found keys, or xortkey for a key dictionary result.


XOR block

ROL

The Rol section shows the bitwise rol used. You can click the sha256 link for a hex dump of the section, and click (str) for the extracted strings. 

Rol/Ror block


Dropped Files

The dropped files section is similar, click the number (1) to see the hexdump and (str) to see the strings. The strings section can help to get a quick ID of the trojan or find some unique strings for a quick Yara rule.

Tip: hex dumps can be converted back to files: # xxd -r webhexdump.txt > malware.virus

dropped file hex dump


dropped file extracted strings

JSON

The bottom of the page has links to a JSON version of the report and a JSON of the submissions (date, original filenames).


Thursday, September 8, 2016

QuickSand.io in depth

In addition to our Cryptam tool. We created QuickSand.io, a fast C document forensics tool which can conduct cryptanalysis attacks on some XOR ciphers. QuickSand is a CLI, a C Library, and can be wrapped in a web interface.

QuickSand has a lot more user-customizable attack options for special cases while keeping the default analysis as fast as possible.

Exploits

Known exploits are scanned used embedded Yara, document streams are decoded - hex, base 64, zip, gzip. We don't handle PDF streams - you'll still need PDFExaminer.com for that.

Finding Embedded exe's

XOR+Rol from 20-10 bytes are found instantly with the default cryptanalysis attack.

Optional attacks

XOR Lookahead - where the current byte is xored with the following byte.
Math ciphers - +1 to +255 (equivalent to -1 to -255).
Bitwise not
Brute force 1 byte xor - for when null space is not replaced.
Odd XOR lengths


Example odd xor length:

This sample contains an exe obfuscated with a 21 byte XOR key:
./quicksand.out malware/112c64f7c07a959a1cbff6621850a4ad-2.virus -s 21 -e 50000
 -0> root {3}
  md5:112c64f7c07a959a1cbff6621850a4ad
  sha1:e7f7f6caaede6cc29c2e7e4888019f2d1be37cef
  sha256:9e5fbd79d8febe7a162cd5200041772db60dc83244605b1ff37ef8d14334f512
  sha512:45e7807bc0ed6b8ab6ecf458c34edebb8781ed928e0b0649d73cf0d981513113160afc3c1dee5cd290a0053357d155fe1b129d342fc2d1072bcb039e972cc61b
  size:367631
  yara:exploits:exploit_cve_2015_2424
  score:30
  is_malware:2

  -1> xor {3}
   md5:31e676fd243e031170be515987784883
   sha1:69b22e4bd485f4486cf0f16aa4f894acb530b6f8
   sha256:a78eb148cd918b0e3e31a42dcfa3eaade731d9c2a935120d2b05428df06f78a0
   sha512:dd8e5bb444269ab4a3bca4c9754d931c7d70c462b5523e98d4dd5124d8196ada9f3e2675bf077998332de04e625c4e3f61b8b63341d58e614aa8d2e52213e17f
   parentsha256:9e5fbd79d8febe7a162cd5200041772db60dc83244605b1ff37ef8d14334f512
   size:367631
   yara:executable:executable_win_pe
   xorlen:21
   corky:5cf193921cad62018eb1cf638f3f7eacecb041d240

More to follow.