my name is philippe pedes and today
we're gonna talk about mower hunting
discovering techniques in malware no
more malicious pdf right so this is my
contact at twitter at flip piers
my contacts and social media so you can
find here some in my webpage we can find
there some talks that are made in some
events uh in english spanish and
portuguese language my github here
philip 86 in my linkedin so if you'd
like to exchange something with me or
send some questions i'm totally
available right so let me introduce
myself
so i'm security research at sapporo
saporiza company for
from switzerland
and i'm responsible for creating
attacking modules for this company
actually for the product of this
company and i created this i just i
create the design of the attack and send
to the developer team in this team
putting this in our product right i'm
the founder of the black and white
technology it's my my own company i'm an
advisor and ceo of this company it's a
consulting company responsible for
provide services consulting services
actually and for a pen privilege access
management
talk security security operation center
for analysis fantastic and so on and so
on i'm at developer advocate in
different
uh projects
first is hacking's not a crime very
known in in us
and not only us but in europe and i'm
vocate of these projects the idea behind
of this project is to talk more about
this concept in colleen hacking and how
important it is to spread the message
for
many people because
the idea is the hacking is how you can
use your creative mining to help
organization to helping companies
protect their solutions their
organization the product and not only
that but using your creative mind
uh to be a hacker is to using a
lifestyle right so how you can using
your creative mind in your life
okay not how the
the tvs or the newspaper using this this
word or about to a bad guy right so
that's the idea behind of this project
and i'm advocate of the senior segura
senior siguri it's a global company from
brazil by the way um responsible for
providing different solutions
for a pen a privileged access management
and different
authentication process actually in
ambassador of the sneak open source
project right so this is the solution to
protect the company actually producing
assassin's solution a statistic analysis
coding from the developer process
actually and not only that but sca
analysis composition a scan analysis
composition actually looking from the
libraries inside of the code and i'm
ambassador of this project right and i'm
a structured writer any viewer those at
three magazines in europe fantastic
magazine hockey 90 and net forensic and
by the way i i am a structure of the
specifically course course about the
malware attack with the key chain in the
dashing magazine so if you would like to
know more about that so you
can send them a message right so this is
some informations about me and before to
talk more about technical stuff so it's
important to put all those peoples and
the same equation first of all i would
like to just a simple explanation what
is a thread is according this iso is uh
is defined as a potential cause of an
incident
that may cause arming to the system in
organization but what does that mean
phillip basically maybe is a softer
attack on a specific exploitation
about attack in software is a kind of a
tough intellectual property so if you
are if you produce some code or some
product or if you have some intellectual
property or some attacker or a threat
actor try to
to test this
intellectual property so it's
it is a threat another is identity death
so for example if you have an
organization and some user has a
specifically
uh authentication proc process or
identity to authenticate something so
it's something about the death of this
specific identity it's a kind of threat
sabotage is not another part of this um
the threat because
if someone talk about your organization
on twitter or other social media for
example to try
uh you know
pose some damage in the image of your
company it's a kind of subutation is it
is a threat okay and information
distortion are example of information
security thread just a simple definition
why it's important to understand that
because we are talking today about
the
malware and how you need to looking from
these and how you can look in more
deeply about that so malware is
basically its acronym of the malicious
software so it's a potential thread so
because of that it's important to
clarify what is a threat now definition
from fleet is definition from these eyes
okay
so let's talk about this simple uh flow
about the malware analysis okay so first
of all we have a possible a thread or
artifact or a symbol so this is the
first step the identification step right
so as you can see here we have a mower
it's acronym of the malicious software
or or modok malicious document right so
remember you receive to analyze and
specifically artifact or simple so you
need to understand if he is a mower or
is a small dog depends on the binary or
the station not only that but many other
factors not factors but points that you
need to analyze after that you need to
choose what the best methodology you use
when you analyze something like you can
use any statistical analysis and dynamic
analysis two different approaches okay
so my recommendations to you when you
perform something like this it's
important you
write this like you know um about all
those steps that you are analyzing when
you make something for example you have
received this artifact you need to
register all those steps because when
you do that
you can understand about the steps that
possible attack using this attack and
not only that but you can produce
something like a report in this report
you can present for example your manager
your coordinator your tech lead or you
can produce some article for example
about your studies for example it's
another interesting point and not only
that but
you can create a specifically
improvement not create but you can help
your organization your company to
improve defense's mechanism because when
you understand what kind of technique
used by the attacker you can understand
what kind of technique this threat actor
or this attacker using to buy best the
security sensor in your organization
like a fire like ibs like ids like a
possible sandbox or other tools that you
have in your environment or antivirus
egr so you can understand the technique
used by the attacker to bypass those
solutions and not only that but you can
suggest it as improvement for your
defense's mechanism
and you can um
creating this good word called cti or
cyber threat intelligence you can build
it in your organization i know that it's
not too easy to create this if you're a
small company but nowadays we have many
tools to help you to give this
information um
like
for example misp it's a malware sharing
platform that you can use in an open
source project by the way using for
example elasticsearch to
correlating the logs or other things
like these so you can create these
intelligence your organizations and you
need to restrain cyber resilience you
need to have this resilience because the
threats are changing all the time so so
we need to
calculate of course it's difficult
probably you can using some tools to
help you to calculate the resistance
against the thread in your environment
but remember
this is a defensive approach to
understand how you can use in the
offensive mindset okay so this is the
simple flow using in our analysis in our
studies so remember this is the first
step the statistical analysis and
dynamic analysis probably you already
heard about that but if you are new here
it's important you understand those
differences so simple like this what is
a statistic analysis when you talk about
the moral analysis uh it usually is the
first step using in the malware is
studies why because the statistical
describe the process of analyzing the
program code it means that you you will
looking more deeply about the structure
of the specific code when you receive
the binary we need to look more deeply
about that
or you can find and specifically
function important by the dll using this
attack or what kind of dll this at this
specifically binary we're using your
system operation to executing this
attack in this specific environment
right so the program itself doesn't run
in in this time so because of that it's
more safe when you analyze because we're
looking from the
behave no behavior but you're looking
the code the program code so maybe you
are thinking about the reversing
engineers and why where is the reversing
engineering here philippe basically
reversing engineer if you are new here
again is a technique that you can use in
inside of the statistical analysis not
only that but you can use it in dynamic
analysis and we explain what the
difference between statistical and
dynamic but it's important to understand
before to looking deeply about the
reversal engineering you need understand
those bases right so what is statistical
analysis what is dynamic analysis how
the tools can help you how the structure
of the binary works and after that you
can look in more about the reverse
engineering through looking for
debuggers looking for uh um assembly
code and so on and so on okay
so let's talk about the dynamic analysis
this is the second
methodology that you can use in in our
studies right so dynamic analysis based
on behavior in this case basically is
the interactions that the malware or
modok has when is executed in this
environment basically is the runtime
analysis remember so you have a two
approach
no run timing and runtime analysis one
is a statistic analysis that you can
look in from the
structure of the code the functions the
dlls libraries and another it's a
runtime so you pick up the malware you
put in a specific environment control
that environment remember that and you
execute itself inside of this controller
environment you will see the behavior
and after that you check
if is militia or not
and by the way
it can be
easily automated and basically we have a
specific concept calling send blocks
that call it sandbox actually
baby maybe you are already heard about
what is exactly sandbox it's is a
specific environment basically it's a
virtual machine
when you talk about them or analysis or
you know to analyze or or investigated
ready hunting so on and so on basically
you have the mower here who is good
inside of this specific environment and
you see the behavior but it's not only
virtual machine
to see if this is if this binary is
malicious or not you need to we need to
have inside of decent box
engines
to see the behavior basically it means
i probably already heard about what is a
virus total is antivirus scanning you
have the boundary the binary you're
putting this inside of this
antivirus scanning and basin based on
many engines inside of this antivirus
scanning you can see if this mower is
malicious or this is the sample actually
it's malicious or not so based on this
engine inside of that right so sandbox
you need to have the same concept
same concept you need to have this age
inside of that for example you have many
different open source projects like coco
and like others so now you show you
during these presentations right so
remember synthboc is not only virtual
machine you need to have this engine
inside of that right so okay before to
talk about the structure of the pdf
files we need to see more about the
structure of the binary it's important
to clarify those difference
okay so let's talk about that now in my
virtual machine in live code here to you
okay
so
sorry for that so i have here many
different symbols
and some some examples of this probably
is malicious and other non-malicious so
we need to check this and to see the
difference between and one fire or
another so let's check first of all
remember the flow identification step
you receive this binary you need to
analyze that so i have here the amazon
file so i'm using file command to see
what kind of type of
this file is right
the second file that we're using i would
check is amazon.com
x sorry is a microsoft word is almost
the same let me check my friend bill
here i have enough file view is a pdf
file let me check here malware.python
maybe it's a python script
yes it's a item script let me check the
simple pdf is a simple and top text
it's not it's a text but it's a python
script but with a difference
and another is a tar pdf is a pdf file
okay so take a look at this we have a
different binaries here different files
so remember you receive this in your
position
let's suppose that you want an analyst
some researcher more analyst or whatever
so you need to look in more deeply about
that so
sorry this is my point here so what is
important to see here in this
conversation right so first we need to
understand if this file is really
a malware or not let me check here the
file mower dock python here for example
okay let me read
first not i will not is it good himself
but it's not a mower actually let's
check here so let me try to as i could
hear like a python
nine
in malware let's see here okay so it's a
simple code in python take a look this
it's a python script and if you see here
basically this is a some information
that we have in the beginning in here we
have another file and by the way if i
change here let's let me manipulate
something here
in this file
okay let me cut here and i will save
once again
and i will try to execute again
the same
python39
author nine python three block9 actually
mower widen and take a look this is the
same you see so if you're using once
again file take a look the difference so
here we have a mower we have this python
script
and we have here ascii text executable
but here i changed something in the
beginning i cut this part as you can see
here
and we changing this information so file
identified the type of the file in a
different way if you see here so let me
change the other thing here in this file
if
i try
to
let me manipulate once again
okay let me put here put here pdf or
actually not pdf percent pdf i think is
better
1.7 maybe or i can use dash here i think
it's more and then you save
yes and let's check if what happened
here
wow take a look at this so now we have a
pdf document and if i try to execute
once again
in python
we have a problem here because i have
this syntax problem okay because now the
file types is different is pdf
so take a look this i have here pdf ide
is a tools from dda stevens and i have a
view here and i will perform this
sorry perform these tools executing here
to analyze and specifically
to
search for some simple or some
information inside of this pdf okay pdf
id
so if you see here i have a different
object i will explain the difference
between this uh during this conversation
but just to show you something let me
using this the same pdf ide
for a mower dock python but philip is
not a pilot is a
an station
and i isolating
something but take a look at this
now this full pdf id
identified
these
simple has a pdf
even this
binary
having another extension you see
and take a look at this
and um let me check other let me change
something move mower
dock
to mower
dock pdf
i will change the next station pdf id
and i would try to see is the same but
if you see
i
it's occurring python once again
once again i will show you the content
of this
is
continue to be the same is the same
content right but when i try to using
pdf id
this these tools identify has a are
really a pdf file you see
and file
the same case is a pdf document
i manipulate something inside of the
binary so my question to you is
what exactly information i'm
manipulating inside of this binary so
think about that okay so let me change
other things here so no no mower pdf
again and i will cut here and i will
save once again
and now i have
the same content i just cut in the first
beginning of the information let me try
to executing python once again probably
we will have some problem
but i will try powerdoc pdf let me try
to as i could probably receive some
effort no we don't ever we ever hear why
because the extension is different so
what happened here so if i try once
again
oh jesus now we have an ascii text
and let me manipulate other thing here
in the beginning of this
file let me return here once again sorry
and this is specifically
ping python i will copy here let's check
here
i will cop these as you can see
okay
and i'll you manipulate once again this
file
enter i will pass here as you can see i
will save once again
biomower take a look this wow is a fine
script
binary let me
try using python once again so probably
works now continue works because
i need to write the correct way so it
works here so i changing here something
and i will try again
works again so let me use in pdf ig
because it's a mower it's a pdf once
again and take a look this
wow it's not a pdf document
take a look this so
something happened here
that's the point here of this object of
this conversation today
so i am using different tools to
investigate and to see the remember i
received this
remember in your situation so you work
in yard company you receive this file
and you need to analyze that you
you need to use any i'm sure i suggested
it you need to use you you should use
these two in your analysis but you need
to understand how each tool works
so here let me explain about the file
command
what kind of information remember my
about my question what information file
you use
uses to collect the information inside
of the binary here is the information
collected by the file okay so
this file have a magic number probably
if you are
uh you know if not a beginner if you are
a senior a plan a medium guy a medium
analyst or if you are a senior a
specialist or you know um i don't know
principal pro you obvious obviously you
know about that about what is exactly
magic number and each binary has a
specifically magical number it's some
binary is difficult to manipulate i made
some manipulations actually in python
code and pdf it's easier in this case
but file
c
in the each binary the magic number
basically this is important information
they looking for this and basically the
magic the file tools actually this
binary this is a codable inside of the
system operation
the
the file using specifically databases to
find those information and those bad
databases is here inside of this
specifically
um
path inside of this temperature but of
course it's compiling because of that
you can you cannot see this information
inside of that but i download this
information this explanation i using by
the another researcher my friend fernand
mercies he hasn't specifically video
explained many details about the file
but in portuguese language importantly
but probably you can use in subscribe
subscription to see but i collect those
the idea behind of this from this video
basically friend mercies okay and i
download the file database to share with
you about how this works okay
so if you see here i have many different
database
used by unix platform right so if i cut
here pdf for example you can see here
how many
sorry how many
informations rules and strings
the file command using
uh for a magic number okay that's
important thing
here okay as you can see here in the
beginning if you see here person pdf
dash this is the string that you can see
in the beginning so if you read for a
python for example
take a look this
we can see here the beginning of the
information you see
some information you can see in the
beginning of the code strings and other
things like this for example like
user bing python and others and others
of course not only one but more than one
that you can find
in the specifically database that you
can see here so that's very interesting
so let me see for example a javascript
one a very interesting thing so if you
see here in the beginning
dash bing node
let me copy here and manipulate the last
time here our uh document here so let me
return here in the malware folder none
of our pdf and now you cut here and i
will pass
and let's see what happen if i can do
this the last one biomower
take a look this and pow we have
executable in this case they use in a
different way but
if you see now we have a javascript
and different way because a script is
equal
means very very interesting so if you
see here other is a root
malware
file
magic
and
what is another mag
deer
back deer and javascript
javascript and
you can see here node.js for example
let me copy
manipulate once again
paste here and now you cut oh just to
put the js in the end actually fire
mower
you see
is a
node.js
script so it's very important thing
other thing interesting here is about
this informations about the structure of
the binder of course i will talk more
about the pdf but i will explain more
about that about this structure if you
see here in the manual take a look this
information is interesting here about
the elf
we don't have a time to talk about the
healthy structure or pe portable
executable but here we have a specific
information about the format
of the alpha structure actually so how
the how is the difference or how you can
find the array inside of these how the
informations you can find these for
example let me copy here just to show
you here in this presentation so let me
locate here
um
now you pass here
let me find here is uh
headers is what is located here is okay
is here user
it's here
so i will copy here
and are you sure you're simple this is
not
better
no
best
and take a look this this file define is
standard elf types is structured in
macros
you see very very interesting
interesting
and useful information
sorry and here you can see how many
bytes you have it
you know divided in specifically uh a
structure of the elf this is the first
one the first array called for example e
identity is a first array that you have
the 16 bytes and and this specific array
you can find the magic number and others
information again we don't have a time
to explain many things here but it's a
topic for another uh talk okay just to
show you so
oops
let me
oh
here no okay so
let's talk about the pdf structure
because it's very important part of our
presentation so we have a physical and
logical structure of the pdf so usually
you have a four parts when you talk
about the pdf okay so we have a rather
it's very common in
many different binary we have a body and
cross reference table and trader let's
looking more deeply about the four parts
inside of the pdf okay so we have a
specifically
version header here
we have a
inside of the body we have a page image
and phones like a shiny thing is inside
of the pdf
in cross reference table we have a
specific locations of the object ethan
the file for a random access okay it
means that we haven't specifically
structure of this uh pdf just let me
share with you here
um
this is my github basically so let me
let's go to the dd air
here
stevens
okay this is the guy the researcher um
dda stephen sorry here's the blog
his blog we can find many informations
about
uh pdf and other structure i would like
to share this specifically uh picture if
you not okay you can find here but i i
think it's more easy so here you can see
pdf tools it's it's
a small ladder but uh
it's very nice
tools that i'm using here in the
in our conversation here is the
fundamental elements
i think we can find here the information
that i do like to share with you
elements let's see if is here
and i think yes
yes it's here so it's old but the
structure is the same you see so take a
look this the header so remember the
magic number is the header percent pdf
dash so here is the
old version that you can read
here is this
different objects that you you have
inside of this specifically pdf and
cross reference table okay
four parts and here is the most
important to see how the structure works
on the pdf take a look this specifically
picture because it's important so here
is how the object pdf works so we have
here the root object is the main object
and you have a two child object right
object two and object
three so if you've seen this picture for
example those uh
these two objects it's totally linked
or referring this specific object one
you see like a tree okay and this is
specific object object four no it's not
related on this object this reference
object two but only reference three like
object three like again like a and as
a big three if you think about that okay
so you see
how this
uh referencing each object in another
object so this is very important you
understand why because for example let
me uh explain about the pdf
id uh in this case bu is a is a one of
these because take a look this we have
here
44 object
so let's check pdf at thor
it's another
how many objects open
how many objects we have here
so in this case we have a six no 16 we
have a
18 objects so remember this picture so
each object
is
connected in the root object and other
child object remember that it's very
important you understand that because in
depends of the specific pdf we have more
than one object to analyze
okay so that's the point here of this
specifically is structure is a location
of the object eaten the fire not only
that but you have it specifically
streaming
it's important part as you can see here
so we have here 16 or streaming to
analyze so if you see for example ptf id
in view i think we don't have any
uh
in this case we have a 8 streaming
usually the streaming in part of
important that attacker using to putting
something malicious inside of that so
that's a oops
that's important thing interesting okay
so and the trailer basically is the
locations of certain object eat in the
body okay so you have a part of this
object ethan de bori that's the shiny
things like a phony image but usually
you have some links like urls okay so to
when you receive some pdf you click in
this url you redirected these access in
a specific web page for example it's the
part of the trailer information okay so
let's go to the specifically
investigation that i made when i receive
any specific pdf let's go through this
step by step so i receive a specific
object and i will receive the cve id
it's a uh it's um
you know resume actually so it's very
common for uh uh our recruiter
recruiters okay so remember this is a
part of important to identify if this
objectism is a pdf or not of course just
to show you that important buyer in
part remember
in the beginning of this conversation
explaining about how important you
understand these bases
again probably you you are a senior if
you are a senior or a specialist you
know about that but if you are a
beginner or
starting to a studies of the malware
analysis
you need to understand those base this
is very important okay so
first of all i check the pdf id
to see how many objects i have inside of
this pdf how many streams i could have
and some possible suspicious behavior
okay so i have here
15 objects two strings not only that but
take a look this very interesting
the five reference of javascript two in
js
three in javascript in one open actions
but we don't know what is exactly open
action right but we need to check this
okay cool so the second tool that i'm
using here is a pdf-parser it's another
true from the da stevens so we can use
in here the dash s
to see a possible uh
specific information that you can find
here so i set dash ash
s javascript to check remember we have
three reference so first of all in
object one
the second reference object seven and
third object is object 12 remember three
javascript and js remember two reference
so
if you see here object 12 in object one
others two so i using two
different tools to check the same
information you see so my idea here is
to show you those two different the same
informations in two different tools to
check how important it is to understand
how the tools works and how what kind of
information you can find this the second
flag or command that i'm using here
using pdf parsers is dash um
i think it's w or yeah w is to
find it for a round output data because
my id here is to looking more deeply
about the data not only but about the
pro possible uh streaming right or to
see more information about that to read
our raw data okay first of all we have
an object one and take a look at this
interesting information remember that so
object one
the root and you have a reference in
object two
three four five six and seven seven
remember this not this but this
picture object one referring
seven
until
object
sorry and two object
seven exactly that's correct so remember
this picture object one two three four
five six seven seven objects totally
refer reference it or not reference but
link it on a specific object one as you
can see here in this demo okay so
because of that it's important to
understand this flow
sorry this flow about that sorry for my
for this cough but because i have a
coffee in a few weeks ago and i still
have some problem a few weeks ago not in
the last week actually and okay let's
continue
so if you see here all those objects so
we need to analyze each object to see
and take a look at this we have a
specifically open action
linked with this specific javascript and
here is not a javascript because we
don't have any we don't
we don't use now the correct tools to
looking from this specifically
information and if you see here below
take a look this we still have the
information about open action but feel
it what that means open action so let's
check if i have this information here
i think i don't have these informations
here
yeah we don't have her here but
i don't know
if we have these informations here
i would like to share with you this
information in more details let me check
here if i have here this information
or oh yeah i have here take a look this
was that means okay
nice oh a a
or open action
indicate an automatic automatic
reactions to be performed when the page
or document is filled take a look this
important information
so indicate an automatic
automatic action to be performed when
the page
or document is viewed
so now take a look at this the user or
the recruiter or the talent acquisition
person receive this resume or the cv or
if you of the people of the financial
receiving specifically invoice
when they receive it by mail so they
need to check this email they need to
open this pdf so this is the action open
the page view document right so this is
the action the normal action view
document but after that
when you find this open action it means
that an automatic action will be
performed
when this page is open okay
so it means that
something
will be happen after this view and the
combination of the automatic action and
javascript makes a pdf document very
so what we have here
an open action is a javascript
linkage
means it's a suspicious it's malicious
probably right so if you are analyst
here so we can check this information we
can agree with me that is totally
malicious but let's continue our
investigation okay so now we know what
that means the open action and we need
to find where or is where this
javascript so take a look this other
object
take a look this
font and research an image on here other
resource auto reference object eight and
nine remember the picture okay
reference linked other objects so let me
up here the video remember this image
here
okay it's not this image is yeah
remember this image so object four
link it with another object you see an
object 7 is referring object 10 you see
the image so many childs for the
specifically object you see how
important you understand this
nice
so in this reference we have an object
inside of this object tn
we have a possible javascript so let's
go more deeply another information of
the body
other informations about the body
so let's see
object 11 so remember we have a 15
object so inside of the object 10
we have all the reference object 12 here
and here is the first
streaming
contains streaming not only that but we
have here the flat decode so it means
that we need to decode the content
inside of this stream and here as you
can see the laugh is 36
in this case it's not too big it's it's
a small so maybe we don't have any
important information here but we have a
tool streaming here so we need to find
other streaming or what kind of
information we can find here so here we
have another object take a look this in
object 11
he ferry and objet
13 okay
inside of this object 13 we have a what
we haven't streaming
so inside of this is streaming we have a
what we have a javascript
so and as you can see here the left when
you compare to another is too high
so it means that
the javascript probably malicious we can
find here in this specifically object so
this is
this should be the our
main object to investigate okay so we
need to looking more about that so let's
go to this specifically object okay
so then another tool that i'm using here
it's pdf deca what is a pdf techa is a
handle tool for a manipulating pdf okay
oh
it means you can using to uh
you know creating a pdf
a merge of different pdfs collating pdf
and compress is streaming pages and then
compress or hey compress i mean
uncompress actually or recompress
remember i have a content here inside of
the stream so i need to uncompress this
information so that's my action here so
i have a pdf
tv
the file set the output or i will copy
the information i passed here in the
text and i will set the uncompressed
activity because my idea is to looking
for the simple information the content
inside of this is specifically
streaming remember that in object 13 and
here is the the information is important
we find object 13 the left
we have a content this is the first
technique used by the attacker the
javascript obfuscated so here is the
javascript but this javascript is
obfuscated so you need the zoho skate
this code basically is the second action
so remember we have pdf
this pdf has a javascript
inside those dots just javascript we
have and specifically
open actions remember the when the user
viewed this information
the
attacker will use in a javascript and
here is the first technique used by the
attacker obfuscation technique using
this specific if you see here inside of
this parenthesis you can see
specifically standard number like
you see numbers and more uh
more um
more uh below or not below but if you
see here inside of the parenthesis as
you can see here
letters
numbers other informations as you can
see here so
kind of standard information so after
that i need to dissociate this code
remember so if they use a notification i
need to do so for skate here so i find i
found here some specifically evo
parameter and my idea here if i have a
javascript i will try to rewrite this
information using
html basically this is the idea here so
i i
using this specifically copy and paste
here to facilitate our gamble okay
so
i will copy here and i pass it here the
document right
so you see
i viewed this overskate this javascript
has you can see here so this is the
second action so remember the attacker
using the obfuscation technique i would
describe this code and let's see now
what kind of information we can find
here inside of this is specifically code
so i basically i will rewrite in a in
html file i save
and after that
i give the permission to execute itself
in the
in a web browser because my id is to
open here in the web browser check what
kind of information we can find
here okay so are you using firefox to
call
code is simple and let's see what
happened now take a look this and
we have a payload you know what that
means so probably if you again probably
if you know no problem but the payload
is a part of code is a package
responsible to download or to disk just
you know download individual machine
actually
and this package is responsible to
execute the callback
to the cnc commanding controller to
make a response to the attacker okay so
remember
inside of this streaming remember we
have a a javascript obfuscated inside of
javascript javascript we have a payload
this payload basically is the package
that he will explore the vpn machine and
after that what i'm using here i will
see the
standard
you know ladders and percent i will copy
and paste here and i put in here in a
specifically file and my idea here is to
try or to find in specific informations
are using said to cut this information
because here we have now a pure
pure
code
used by the attacker the attacker using
specific
unicode
technique
to
encode informations here so and not only
that but i use in here in unix platform
but i use in here in windows 2 because i
would like to show to show you different
approach not only in unix but using
linux so here's the same uh mower the
same artifact as you can see here take a
look at this the javascript obfuscated
and i'm using here another platform in
use in windows
platform to show you those difference
okay so
here is the the real payload remember
have you cop
and i use sat in in when i using the
linux platform but here you're using
mouse dealer okay so when you up here
and i will pass and i will share with
you here what kind of technique using by
the attacker remember i mentioned about
the specifically encode technique used
by the attacker because remember we have
a payload and the attacker using a
specifically unique encoding technique
to encode this content inside of this
payload and this encoding this
technique used by the attacker is used
by
ucs
okay it's not too it's not new it's old
now the evolution actually we have a new
utf-16 which i have 32 and so on and so
on but before that we had
ucs2 it's old okay so
i using here ucs2 to generate here so i
will basically to
uh decode this information to generate a
extra decimal information as you can see
here and now i have an extra decimal
fire file okay so after that i generate
this extra decimal file in a binary why
i do that because remember this not
remember but usually the most of our
more than 90 percent is
for the windows platform so i generate
this specifically binary to execute
itself inside of the windows machine and
after that i call i use ensure
to
search for a possible http protocol
inside of this binary to see if this
binary will cause something and take a
look what i found here i found the
commander in controller from the
attacker so now we haven't cnc the
attacker remember about the payload
yes the payload is a will be
a callback
or
these is specifically
cnc you see how interesting is so if you
pass here the
ip address you see this ip address is
from estonia europe okay so here as you
can see this is the information we found
in this specific file so let me just to
finalize this information so if you see
here so many urls related to the
specifically attack and if you see here
so they have a many victims machine
explored by this specifically attack
using ptf
malicious okay so just to summarize this
uh demo
actually remember the user received this
pdf
this pdf has a specifically javascript
inside of that
this pdf
is
or was in this case
uh
obfuscated
or javascript obfuscated
inside of this javascript remember this
javascript
is ethan
is streaming this content is inside of
this is streaming
and we deserve skate that this
information inside of that the attacker
using a specifically
encoding techniques actually inside of
the javascript we have a payload
remember the payload is a package
responsible for this callback
this information actually this
information you know so the victory
machine into the attacker remember that
inside of this payload we have another
technique used by the attack this
encoding technique using ec ec ucs2
and inside of that
we have a cnc responsible for this
explanation okay
so here i can suggest you some books
would you like to read and study more
about the ali so here four books
that i can recommend you write about the
moral analysis power analysis techniques
stratified with the elasticity stack and
practical spread intelligence and data
driven 3d hunting soft four very nice
books that i can recommend you if you
would you like to read instead more
about that and that said that's it so i
finished my presentation here i hope
that i can help you during this journey
in our conversation so if you have any
question so please let me know and see
you in the next