Auto Analysis w CAPA
Decompiler Anlalysis & Patching
Based on the initial Triage and behavioural analysis, assuming there is no anti-reversing applied - you should know by now what the program attempts to do and what type of file you're dealing with.
Static analysis allows you to get more intimate with the program, learn more about the execution flow and the addresses of specific functions, that perform interesting operations. It may also allow you to uncover hidden features of the program that are not obvious on basic detonation.
This stage also comes into play when anti-reversing techniques are applied (which curtail the impact of behavioural analysis). You may be required to analyse and patch the program in order to obtain full execution. For a reference sheet to assembly see: 1 - Assembly_ref and for a reference to interesting Windows API functions, see 2 - WinAPI_ref
| Questions to ask |
|---|
| What modules are executed (and in what order)? |
| What does the program aim to do? |
| Have you identified any interesting addresses (e.g. address at which an interesting function call is made.. something that can be viewed in a debugger) |
| Have you identified any potential anti-debugging features? Can this quickly be patched while performing static analysis? |
| Is the program likely to be malicious? What type of malwr? dropper? stager? Does it have shellcode? etc. |
Mandiant's CAPA: https://github.com/mandiant/capa This tool performs automated static analysis on the target file. It makes references to the MITRE Framework based on its analysis and findings
CAPA.exe <filename> -vv
3.1
3.2
Cutter's goal is to be an advanced FREE and open-source reverse-engineering platform while keeping the user experience at mind. Cutter is created by reverse engineers for reverse engineers.
Cutter has the following tabs: Strings | Imports | Disassmebly | Graph | Decompiler | HexDump and more
In cutter once you open a file, you can allow auto analysis.
You can find Cutter releases on github on the following link:
Key shortcuts:
| Shortcut | Function |
|---|---|
| Esc | Seek to previous position |
| Space | Switch to disassmebly or graph view |
| Ctrl/Cmd+MouseWheel | Zoom |
| J | Next instruction |
| K | Previous instruction |
| T | Follow True/Unconditional branch |
| F | Follow False/Unconditional branch |
| X | Find x-reference to item |
X to find callers.G (address or symbol); Esc/Ctrl+Enter for navigation history.F5 in Disasm to open pseudocode.String Reference
Search for known strings and then look at their references to find the relevant sections of the program to analyse
Module Call Reference
Search for the modules and then look at their references to find the relevant sections of the program to analyse
Follow the PE Entrypoint
Go to: MainCRTStarup() and go to the bottom of the execution flow. Work backwards to find main()
references:
https://www.youtube.com/watch?v=tWSa1L5L394
If during analysis, whether static or dynamic, you have obtained any shellcode, you can use scdbg.exe to try to determine what that shellcode does. This tool decompiles shellcode and presents winapi function that it attempts to run as well as their arguments.
Note: The shellcode should be in its raw hex format as a .bin file. e.g.
This may require you to carve out the shellcode and format it so that it contains the raw hex, and have it save as a bin file. Once you have your bin file, run the following command:
scdbg.exe /f \<shellcode.bin> -s -1
3.3
.dex files to .jar..dex directly to Java; also support for .apk..apk..jar..jar in GUI to view Java code.onCreate, run, etc.3.4
3.5
Shellcode Analysis (if applicable)
Other Artifact Analysis
3.6