recommendation of perfect unpacking

Recommendation ofPerfect Unpacking

2014/04/24JPCERT/CC Analysis CenterNAKATSURU You

Copyright©2014 JPCERT/CC All rights reserved.1

Windows Malware Analysis

Data

Code

HeaderSurface• Properties• The Internet

Runtime• Execution &

monitoring

Static• Reading code

Analysis


What Packing/Unpacking is"Pack" original code for compression/obfuscation

Data

Code

Header Header

Compresseddata

Unpack code

Pack

Exec(Unpack)


Unpacking Tools

Unpacker

UPX, etc.

Debugger

OllyDbg

Immunity Debugger

IDA

IAT reconstructor

ImpREC

Hex editor

FileInsight

HxD


CLASSIC UNPACKING


What "Classic Unpacking" is

.header

Memory

UPX0

UPX1

.rsrc

.header

UPX1

.rsrc(Compressed

data)

UPX0

Empty section

.header

UPX1

.rsrc(Compressed

data)



.header

Memory

UPX0

UPX1

.rsrc

.header

UPX1

.rsrc(Compressed

data)

UPX0 UPX0(Original code)

.header

UPX1

.rsrc(Compressed

data)

Execute until Original Entry Point (OEP)



.header

Memory

UPX0

UPX1

.rsrc

.header

UPX1

.rsrc(Compressed

data)

UPX0

.header

UPX0

UPX1

.rsrc(Compressed

data)

.mackt

UPX0(Original code)

.header

UPX1

.rsrc(Compressed

data)

Memory dump & reconstruct PE file


Classic Unpacking Flow

1. Execute unpack code•Find OEP

2. Dump as a PE file• reconstruct PE header, etc.

3. Reconstruct Import Address Table (IAT)


Reconstructing IAT

extrn GetProcAddress:dwordextrn VirtualProtect:dwordextrn VirtualAlloc:dwordextrn VirtualFree:dwordextrn ExitProcess:dword

kernel32.dllGetProcAddressVirtualProtectVirtualAllocVirtualFreeExitProcess

PE File IAT on MemoryImport Directory

IAT


Reconstructing IAT



extrn RegQueryValueExA:dwordextrn RegSetValueExA:dwordextrn RegEnumKeyA:dwordextrn RegEnumValueA:dwordextrn RegOpenKeyExA:dwordextrn RegDeleteKeyA:dwordextrn RegDeleteValueA:dwordextrn RegCloseKey:dwordextrn RegCreateKeyExA:dword

PE File IAT on Memory

Created by unpack code

IATIAT


Reconstructing IAT





Can not import required APIs

IAT


Reconstructing IAT




RegQueryValueExARegSetValueExARegEnumKeyARegEnumValueARegOpenKeyExARegDeleteKeyARegDeleteValueARegCloseKeyRegCreateKeyExA


IATIAT


Classic UnpackingReconstruct PE file


Classic UnpackingReconstruct IAT

Input OEP


Classic UnpackingReconstruct IAT


Classic Unpacking Issue

.header

.text

.data

.rsrc

.mackt

.header

.text

.data

.reloc

hash("Original") != hash("Unpacked")

.header

.data

.rsrc

.text


Classic Unpacking Issue.header

.text

.data

.rsrc

.mackt

.header

.text

.data

.reloc

.header

.data

.rsrc

.text

.header

.data

.rsrc

.text

.header

.data

.rsrc

.text

.header

.text

.data

.rsrc

.mackt

.header

.text

.data

.rsrc


PERFECT UNPACKING


Concept

.header

.data

.rsrc

.text

.header

.text

.data

.reloc

hash("Original") == hash("Unpacked")

.header

.text

.data

.reloc


Recent Packer

.header

Memory

.text

.data

.rsrc

.header

.data

.rsrc

.text.header

.data

.rsrc

.text


Recent Packer

.header

Memory

.text

.data

.rsrc

.header

.data

.rsrc

.text

Unpack code

.header

.data

.rsrc

.text


Recent Packer

.header

Memory

.text

.data

.rsrc

Original PE file

.header

.data

.rsrc

.text

Unpack code

.header

.data

.rsrc

.text


Recent Packer

.header

Memory

.text

.data

.rsrc

Original PE file

.header

.data

.rsrc

.text

Unpack code

.header

.data

.reloc

.text.header

.data

.rsrc

.text

Overwrite own process / Inject into other process


Recent Packer

.header

Memory

.text

.data

.rsrc

Original PE file

.header

.data

.rsrc

.text

Unpack code

.header

.data

.reloc

.text.header

.data

.rsrc

.text

.header

.text

.data

.reloc


Perfect Unpacking Flow

1. Execute unpack code• Let unpack code unpack

original PE file

2. Dump memory section contains original PE file

3. Trim PE file


1. Unpack Code ExecutionSet breakpoints on

•WriteProcessMemory•ZwWriteVirtualMemory•CreateProcessW•VirtualFree / RtlFreeHeap•etc.

Windows APIs

•Hardware breakpoint on "M"

PE header


2. Dumping Memory SectionSearch "MZ" string

Ctrl + B



Ctrl + B

Search next (Ctrl+L) until you can see PE header



Ctrl + B

Search next (Ctrl+L) until you can see PE header Raw address


2. Dumping Memory SectionDump


3. Trimming PE fileParse PE file using FileInsight


Consideration

0. Limited availability•Depends on packer's implementation

1. Unpacking code execution•Debugger & VM detection• Breakpoint detection

3. Trimming PE file•Overlay data

•Data used by malware• e.g. ZeuS variants

• Digital signature


Demo MovieGet same original file from different binaries using "Perfect Unpacking"


CONCLUSION


Summary

Classic unpacking issue•Unpacked file's hash value depends on

analyst/tools

Resent packer implementation•Packed malware contains original PE file

We have to perform"Perfect Unpacking"•Dump original PE file from virtual

memory


Recommended Unpacking Flow

Unpacker

Perfect Unpacking

Classic Unpacking

.header

.text

.data

.rsrc

.header

.text

.data

.reloc

Thank you!

[email protected]://www.jpcert.or.jp

Incident [email protected]://www.jpcert.or.jp/form/

mailto:[email protected]

https://www.jpcert.or.jp/

mailto:[email protected]

https://www.jpcert.or.jp/form/

recommendation of perfect unpacking

Documents