2

An SWF file was recently detected by Windows Defender as SWF/Meadgive. I uploaded a sample to VT and only Microsoft flagged it as malicious. As of today's signatures I am not seeing any further detection's and I am hoping this is simply a false positive.

I'm using this as an opportunity to learn more about malware analysis and incident response. To take a deeper dive I opened the file with the JPEXS decompiler, but have no idea on where to go from here. Looking for guidance on how to better understand and analyze this for myself.

Also, are there any online tools/sandboxes that accept swf files that would provide any value?

Improve this question

1 Answer 1

Reset to default
1

According to https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Exploit%3aJS%2fMeadgive this malware will download packages based on existing vulnerabilities.

One way to handle this would be to setup a virtual machine with one of these vulnerabilities and use Wireshark to monitor network activity and ApateDNS to forward any DNS requests to another Linux virtual machine running iNetSim.

Improve this answer
2
  • I've already looked at this on Wireshark and was able to grap a copy of the .swf file. My question more involves how to analyze or RE the file.
    – Heisenberg
    May 12, 2017 at 17:45
  • I found this video which is a helpful walkthrough - youtu.be/NySUxsWxaTo
    – Heisenberg
    May 13, 2017 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.