1

I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its decrypted version and do some processing on it. For this I took this polymorphic malware from offensive computing website.

http://oc.gtisc.gatech.edu:8080/search.cgi?search=bolzano MD5: 6eb5fdc7a80cb6b551b7aee3242ea9e4 SHA1: 8f9a97ef3388bc21367f245715d1e930c7dd81c0 SHA256: 0613e465dc0473c210c6e905ce938eaf6adcea800b116d0651f22c782ffb1cdb OCID: 1663401483 Original Filename: Virus.Win32.Bolzano.3628

This virus can be executed in windows NT. So I created vm for windows NT 4.0 SP6. And loaded virus in Ollydbg 1.10. I directly executed executable there. After few seconds virus terminated with exit code 5B. Does this means that when I executed virus , it is decrpyted by decryption routine and executed ? What are ways I can find decryption routine in that virus so that I can understand the exact position of decrypted virus. If I understood that I can put break point after decryption routine and recover the pair.

  • I submitted this sample of ThreatAnalyser sandox here threattracksecurity.com/resources/sandbox-malware-analysis.aspx . In report, it is written that this virus checks for debugger. But how can I see in code that it is checking for debugger and how it behaves in case of debugger. I am not sure whether report I got is correct or not. In executable there is call to GetTickCount API and I read that this API is used to check for debugger. But how can I confirm whether GetTickCount API used in code is for debugger or for some other purpose. – user1744108 Aug 17 '13 at 21:47
  • You don't have to use a debugger. You could jump instrument the VM to dump all memory written by the target process. – Antimony Aug 18 '13 at 1:08
  • Can you please post the link to the ThreatAnalyser report? – PhoeniX Aug 18 '13 at 4:42
  • you seem to create several posts on the same topic why not follow up in one question that makes it easier for you and makes it a good reference for future users as well don't you think reverseengineering.stackexchange.com/questions/2476/… – blabb Aug 18 '13 at 5:18
  • @Antimony: I did not get what you want to say, could you please elaborate in detail ? ph0sec: They sent me PDF file, in report it is written that "virus could not load" , so I think it is crashing on ThreatAnalyser. blabb: Sure that makes sense. I think this question is more related, so I think I should remove last topic – user1744108 Aug 18 '13 at 6:29
1

From analysis of the following report on malwr.com, it looks like the malware has crashed on there system, which could indicate that it also has crashed at yours.

  1. Regarding GetTickCount API, you should check that the call to it is done from the body of the malware and not from the pre-loading environment of console executable. If you find near GetTickCount API also APIs for parsing command line parameters, than it's a false alarm.
  2. As to the finding the OEP (Original Entry Point) I'd suggest to put BP on VirtualAlloc/VirtualAllocEx - as in general, but does not have to, encrypted malware will need extra space to decrypt itself. In that particular case I saw the usage of NtCreateSection which you also should monitor.
    1. After loading the malware in Debugger, try to search for dynamic control transfer, like jumps/calls to value stored in register/de-referenced memory.
    2. Also put BPs on APIs responsible for memory de-allocation (VirtualFree) so you could dump the buffer before its gone.

And for the end, do not immediately rush to a debugger, try to run the malware and look what it does by using ProcMon for example.

UPDATE:
Advise before you dive into dealing with real malware:

  1. Write very simple program.
  2. Download UPX compressor - its open source, as there are a lot of malwares that use it too :)
  3. Compress your program with UPX
  4. Now, try manually decompress your program from the compressed one.

Have fun!

  • I am new to malware analysis. Could you suggest me any simple polymormphic malware which I can use at initial stage and find its encrypted/decrypted pair. I put break point on VirtualAlloc/VirtualAllocEx but it seems virus is not coming here and don't stop its execution. Also regarding tool ProcMon, this tool can be run on windows XP and higher version, but virus which I am using is exectable on windows NT. So I can not use this tool. – user1744108 Aug 18 '13 at 6:47
  • Why is it so important for you to run malwares on Windows NT? – PhoeniX Aug 18 '13 at 7:25
  • because I read about this malware from here spth.virii.lu/29a4/29A-4.505.txt, and at the start it is checking for OS. if it is not windows NT or windows 9X it is giving access violation and terminates. Also on symantec web site it is mentioned that it affects windows NT, windows9x. I am more happy to use windows 7 but then which polymoprhic malware I should choose ? – user1744108 Aug 18 '13 at 15:05
  • I can suggest Shylock malware family for you to practice, versions from 2011 - 2012, but I can not point you to actual link for a malware. Try to look on the Net for it. – PhoeniX Aug 18 '13 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.