5

Today my AV found an antique piece of malware called Win9X.CIH.dam. Instead of just removing it I would like to make a little research for fun.

enter image description here

What does "data0513" exactly mean? I can't understand what the 0513 is. I suppose it's some kind of offset but can't figure out from where.

I'd like to dump the malware out of the host executable and disassemble it.

Improve this question
3

This is likely something specific to the AV. A few possibilities come to mind:

  1. an archive member in case the exe has an embedded archive
  2. overlay area (data beyond the area covered by sections)
  3. PE resources

  4. ...something else...

    0513 seems to be too small to be an offset so I suspect it's a sequence number. To know more you'll probably need to RE the AV engine to figure out what naming scheme it uses and how the numbers are assigned.

Improve this answer
1
  • To expand on the "something else" an offset or sequence number (or the last hex digits of a hash or checksum) related to the rule matching the malware ... – 0xC0000022L♦ Jun 13 '18 at 20:34
2

You don't have a reliable way of knowing what that naming schema means more than reverse engineering your AV software itself.

Some AVs have the option to dump the malware. Maybe yours does, but it is not likely the case because the regular user would never use that feature and it may be risky.

You can use a tool like: Virustotal

To preprocess your file and get some more insight on what the file is. VirusTotal it is not a tool just for scanning for malware as one may think. It has a very decent amount of automatic static binary analysis which you may find useful. That tool may throw you the offsets of the regions on which the malware lives, letting you extract it, for example.

Then continue your research with your own tools.

Improve this answer
4
  • Could you explain how VirusTotal would be of help here? – 0xC0000022L♦ Jun 13 '18 at 20:35
  • With a hash of the original file you could look up o VirusTotal (etc) what 60+ other scanning engines think of your sample which might give you useful information. You could follow the references to threat descriptions or reports and learn more about your KIS found. – adric Jun 15 '18 at 17:26
  • Good explanation adric. I'm editing. – 0xfede7c8 Jun 15 '18 at 20:12
  • Where/how can VirusTotal "may throw you the offsets of the regions on which the malware lives"? – NirIzr Jun 16 '18 at 23:32
1

The value could well be an absolute offset within the file, though it seems unlikely. CIH inserted itself into spaces between the end of the file header and the start of the section, and between the end of one section and the start of the next, etc. It changed the PE entrypoint field to point to itself so that it ran immediately. If you use a disassembler such as IDA, you will be able to see the code, and from there you can extract it with a hex editor or similar.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.