2

An SWF file was recently detected by Windows Defender as SWF/Meadgive. I uploaded a sample to VT and only Microsoft flagged it as malicious. As of today's signatures I am not seeing any further detection's and I am hoping this is simply a false positive.

I'm using this as an opportunity to learn more about malware analysis and incident response. To take a deeper dive I opened the file with the JPEXS decompiler, but have no idea on where to go from here. Looking for guidance on how to better understand and analyze this for myself.

Also, are there any online tools/sandboxes that accept swf files that would provide any value?

1

According to https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Exploit%3aJS%2fMeadgive this malware will download packages based on existing vulnerabilities.

One way to handle this would be to setup a virtual machine with one of these vulnerabilities and use Wireshark to monitor network activity and ApateDNS to forward any DNS requests to another Linux virtual machine running iNetSim.

  • I've already looked at this on Wireshark and was able to grap a copy of the .swf file. My question more involves how to analyze or RE the file. – Heisenberg May 12 '17 at 17:45
  • I found this video which is a helpful walkthrough - youtu.be/NySUxsWxaTo – Heisenberg May 13 '17 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.