恶意分析 on F145H 的博客

恶意软件分析

Mon, 27 Oct 2025 00:00:00 +0800

Basic knowledge

恶意软件种类划分

根据分析方法，可以将恶意软件分析分为以下四种

基础静态分析
基础动态分析
高级静态分析
高级动态分析

根据种类，可以将恶意软件分为以下九种

Backdoor
Botnet
Downloader
Launcher
Information-stealing malware
Rookit
Scareware
Spam-sending malware
Worm or virus

PE头相关知识

导入未列出的链接函数

LoadLibrary
GetProcAddress
LdrLoadDll
LdrGetProcAddress

关于导入函数名公约

当微软更新一个和旧版本不兼容的新功能时，会在新的函数后方加入 Ex，且可以叠加如 ExEx。这代表这个函数经历了两次这种类型的更新，且旧版本会继续被支持。而 A 或 W 的后缀仅表示这个函数支持 ASCII String 或 WCHAR String 类型的输入。

恶意代码分析实战-Labs

Thu, 23 Oct 2025 00:00:00 +0800

1

1-1

先将文件Hash上传 VirusTotal 查看信息

使用 PEStudio 查看文件信息，可以知道编译时间

查看节区表信息，认为没有进行加壳或混淆

查看导入表，发现有使用网络传输的模块，和遍历本地文件的模块，认为可能是泄露本地信息的恶意行为。

在 strings 中可以看到有一个形似 kernel32.dll 的 kerne132.dll。

在 strings 中可以看到有一个IP地址。

根据以上信息认为是一个 Uploader 或者是一个 Downloader

1-2

上传至 VirusTotal 查看报告

使用 DIE 和 PEStudio 都可以看到，DIE 检测到有 UPX 壳，而节区表中的节区名为 UPX0 UPX1 是明显的 UPX 加壳特征。使用 UPX 官方软件脱壳即可。

简单的关于环境设置

Thu, 23 Oct 2025 00:00:00 +0800

核心组件安装

flarevm

https://github.com/ionuttbara/windows-defender-remover/releases/tag/release_def_12_8_4

它真的会耗费很长时间…

完成后继续安装一些必要软件如 mingw 等，并手动设置环境变量和位置。

choco install mingw

注意： flarevm 的正常组件中是不包括 IDA Pro 的（除非你持有正版许可证）

remnux

https://remnux.org/

网络配置

处于安全性，虚拟机必须与外界网络隔离。

在 vmware 创建一个 /dev/vmnet2 hostonly 来保证环境的安全性。

设置 flarevm 10.0.0.2/24 和 remnux 10.0.0.3/24 并将 flarevm 的 dns 和网关指向 remnux。

PMAT-labs Challenge 1: SillyPutty

Sat, 27 Sep 2025 00:00:00 +0800

首先，看一下 README.md 的信息

Hello Analyst,

The help desk has received a few calls from different IT admins regarding the attached program. They say that they've been using this program with no problems until recently. Now, it's crashing randomly and popping up blue windows when it's run. I don't like the sound of that. Do your thing!

IR Team

## Objective
Perform basic static and basic dynamic analysis on this malware sample and extract facts about the malware's behavior. Answer the challenge questions below. If you get stuck, the `answers/` directory has the answers to the challenge.

## Tools
Basic Static:
- File hashes
- VirusTotal
- FLOSS
- PEStudio
- PEView

Basic Dynamic Analysis
- Wireshark
- Inetsim
- Netcat
- TCPView
- Procmon

## Challenge Questions:

### Basic Static Analysis
---

- What is the SHA256 hash of the sample?
- What architecture is this binary?
- Are there any results from submitting the SHA256 hash to VirusTotal?
- Describe the results of pulling the strings from this binary. Record and describe any strings that are potentially interesting. Can any interesting information be extracted from the strings?
- Describe the results of inspecting the IAT for this binary. Are there any imports worth noting?
- Is it likely that this binary is packed?
---

### Basic Dynamic Analysis
 - Describe initial detonation. Are there any notable occurrences at first detonation? Without internet simulation? With internet simulation?
 - From the host-based indicators perspective, what is the main payload that is initiated at detonation? What tool can you use to identify this?
 - What is the DNS record that is queried at detonation?
 - What is the callback port number at detonation?
 - What is the callback protocol at detonation?
 - How can you use host-based telemetry to identify the DNS record, port, and protocol?
 - Attempt to get the binary to initiate a shell on the localhost. Does a shell spawn? What is needed for a shell to spawn?

现在，我们将围绕这些问题对程序进行分析：