Static-Malware-Analysis

Overview

This project focuses on analyzing malware samples, specifically Portable Executable (PE) files, using a combination of static and dynamic analysis techniques. The primary goal is to extract insights into the malware's functionality, identify any obfuscation techniques, and generate unique identifiers for the analyzed samples.

Environment Setup

Hardware Resources

• Laptop Specifications:
  • RAM: 4 GB
  • Storage: 150 GB hard drive
  • CPU: 4 processors

Network Configuration

• Mode: Host-Only (to ensure isolation and prevent unintended network activity).

Anti-Detection Measures

• VMware Tools: Uninstalled to minimize the likelihood of detection within the virtualized environment.

Tools Used

1. Fakenet: Simulates network activity for malware that attempts to communicate over the network.
2. HxD: Hex editor used to inspect and edit raw binary files.
3. Exeinfo PE: Provides detailed information about PE headers, detects packing, and identifies packer versions.
4. Pestudio: Static analysis tool that evaluates executables and highlights suspicious patterns and indicators.
5. FLOSS: Extracts hidden or obfuscated strings from binary files.
6. UPX: Unpacks compressed executables to reveal their original content.
7. VirusTotal: Online tool to check if the malware sample has been previously analyzed.

Analysis Workflow

Static Analysis

1. Identifying the File Type

   • Determine the target operating system, architecture, and format (e.g., DLL, EXE).

2. Hashing the Malware

   • Generate hashes (MD5, SHA-1, SHA-256) to create a unique fingerprint.
   • Use VirusTotal to check if the file has been previously analyzed.

3. String Analysis

   • Extract ASCII and Unicode strings to gain insights into functionality.
   • Use FLOSS to uncover hidden strings.

4. Packing and Obfuscation

   • Detect packing using tools like Exeinfo PE.
   • If packed, perform unpacking using UPX:

     upx -d game.exe

5. PE Headers Analysis

   • Examine the Portable Executable (PE) header for information about structure and functionality.

Dynamic Analysis

• Simulate malware behavior in a controlled environment using Fakenet.

Key Findings

• Strings Analysis: Extracted strings provided insight into malware behavior, such as registry keys, IP addresses, and file paths.
• Packed Files: Certain files were found to be packed, requiring unpacking using UPX for further analysis.
• Imports Analysis: Analysis of imported functions helped understand the malware's intended functionality.

Commands and Examples

Hashing Malware

md5sum game.exe
sha1sum game.exe
sha256sum game.exe

Analyzing Strings

strings game.exe
floss game.exe

Unpacking Packed Files with UPX

upx -d packed_game.exe

Checking with VirusTotal

1. Generate the hash of the file.
2. Submit the hash to VirusTotal.

Using Exeinfo PE

• Open the tool and load the malware sample to detect packers and PE information.

Simulating Network Activity

fakenet

Detailed Steps

Step-by-Step Process from the PDF

1. Environment Setup:

   • Configure a Host-Only network.
   • Uninstall VMware Tools for stealth.

2. Static Analysis:

   • Use HxD to inspect the file headers and confirm the file type.
   • Generate a hash using MD5, SHA-1, or SHA-256.
   • Perform string analysis using strings and FLOSS to extract readable strings and hidden data.
   • Identify packing using Exeinfo PE and unpack using UPX if needed.
   • Analyze PE headers using Pestudio to extract details about functionality.

3. Dynamic Analysis:

   • Simulate network activity using Fakenet.

4. Final Findings:

   • Summarize insights from string analysis, unpacking, and PE header examination.

Conclusion

This project demonstrated a systematic approach to malware analysis, leveraging a range of tools and techniques to uncover hidden functionality, identify obfuscation methods, and better understand the threats posed by malicious software.

How to Use This Repository

1. Clone the repository:

   git clone https://github.com/7amo127/Static-Malware-Analysis.git

2. Follow the setup instructions to replicate the analysis environment.
3. Use the provided scripts and tools to analyze your own malware samples.

---

For any questions or feedback, please feel free to reach out.