Windows PE files Infections and Heuristic Detection Nicolas BRULEZ / Digital River PACSEC '04
Jan 29, 2016
Windows PE files Infections and Heuristic DetectionNicolas BRULEZ / Digital River
PACSEC '04
Introduction
Evolution of Computer Viruses
• Not Encrypted
• Encrypted
• Oligomorphic
• Polymorphic
• Metamorphic
PE File Format• MZ Header
• Le PE Header
• Le PE File Header
• Le PE optional Header
• Le Data Directory
• Les Sections Headers
Position Independant Code
• Virus needs to be executable at any memory addresses.
• Calcul of a Delta Offset
Windows PE Files Infections Techniques
Virus Position
• Last Section:
- New Section
BEFORE : AFTER :
Virus Position
• Last Section:
- New Section
Virus Position
• Last Section:
- Last Section Expansion
BEFORE: AFTER:
Virus Position
• Last Section:
- Last Section Expansion
Virus Position
• Header Infection
Virus Position
• CavityBEFORE: AFTER:
Entry Point Position
• In the Last Section
Entry Point Position
• In the First Section
Entry Point Position
• Before the First Section
e_lfanew Infection
• e_lfanew is a pointer to the PE Header Offset.
• You can find it at MZ+3Ch in the MZ HEADER.
• Infection by modification of e_lfanew is really straightforward.
• The virus is copied to the end of the file, but it doesn't need to have independant position code.
e_lfanew Infection
• Program is modified so its e_lfanew points to the Virus' PE header.
• Windows will therefore load the virus rather than the infected file.
• The virus will then make a temporary copy of the infected program and patch back the original pointer to PE header.
• The virus will finally run the temp file using CreateProcessA for example and will delete the temp file when this one ends.
Heuristic Detections on Windows PE Files
PE Structure Analysis
Heuristic Detections are mainly based on the PE File Structure
Analysis of Windows Executables.
• Entry Point• Sections Characteristiques• Sections names (with specific Characteristics)• Values not Updated in the PE HEADER.• Position of the PE HEADER in the file etc
PE Structure Analysis
• Entry Point in the Last Section
• Entry Point before the First Section
PE Structure Analysis
• Sections Characteristics :- Last Section « Executable »
- First Section « Writeable »
• Section names AND their Characteristics
PE Structure Analysis
• « SizeOfImage » incorrect in the PE Header
• PE Header near the end of the File
• « Size of Code » incorrect
Code Analysis
• Non Standard Instruction at the Entry Point
• Calcul of a Delta Offset
• Suspicious Code Redirection:
- JUMP FAR
- PUSH RET
etc..
Code Analysis
• Code Looking for PE Files
• Usage of PEB to gain system dlls Image Base
• Hardcoded value of systems important datas (PEB ...)
Code Analysis
• Suspicious Strings Inside Code Sections.
- "*.exe"
- Name of Win Functions: FindFirstFileA, MapViewOfFile etc..
- Registry Keys : Run / RunOnce etc.
Emulation
• JMP FAR
• PUSH / RET
• + Various ways to redirect code flow
• Decryptors Emulation ( Identification of loops)
Anti Heuristic Techniques
PE Structure
• Non Modification of Sections Characteristics
• More than one section added (fake reloc / imports)
• Part of code section overwriting to avoid suspicion.
• Packing of code section to place the virus is freed place
• EPO: Entry Point Obscuring
Structure PE
• FF15/FF25 (call IAT slots) Patches
• Stack Frame Patches
• Updated Checksums
• Existing Sections are renamed (when possible)
• « Size of Code » Fixed
Anti Emulation
• SEH - Structured Exception Handling.
• Co-Processor Instructions
• MMX / SSE Technology
• Undocumented Instructions
• Anti Virtual Machine Code
• Decryption Layers with Brute Forcing of Keys
• Threads
Anti Heuristic Code
• Delta Offset is calculated differently
• Usage of Obfuscation to hide suspect actions. (PE files checking etc)
• No more strings in the virus loader: CRC / HASH
Presentation of a Basic Heuristic Engine
Presentation of a Basic Engine
• Standard Binaries : notepad, regedit, calc, MS Pain, WordPad etc…
Presentation of a Basic Engine
Presentation of a Basic Engine
Presentation of a Basic Engine
Presentation of a Basic Engine
• Analysis of infected Binaries : Polymorphic, Crypted, Standard, EPO etc
Presentation of a Basic Engine
Presentation of a Basic Engine
Presentation of a Basic Engine
Presentation of a Basic Engine
Presentation of a Basic Engine
Presentation of a Basic Engine
Presentation of a Basic Engine
Presentation of a Basic Engine
Presentation of a Basic Engine
Notes:
Although, this is a basic engine, it detected heuristically every
viruses generated with a very recent Win32 Virus Generator.
(VCL32).
Presentation of a Basic Engine
• Analyse of Packed Files : PE protect, PEShield etc…
Presentation of a Basic Engine
Presentation of a Basic Engine
Presentation of a Basic Engine
Live Disassembly Demo
Live Demo
New Worm infected by a new Virus and PE packed.
Live Disassembly of a real virus.
This virus is very recent, and is not detected by most Anti Virus
vendors as im writing those slides.
Conclusion
Any Questions ?Nicolas BRULEZ / Digital River
PACSEC '04