From a2f7da94ed805aeb84e4e0ad01f980fac5faad9c Mon Sep 17 00:00:00 2001 From: Dez Beck Date: Sun, 20 Nov 2022 14:54:26 -0500 Subject: [PATCH 1/5] address issues 63 and 65 --- anti-static-analysis/disassembler-evasion.md | 13 +++++++++---- anti-static-analysis/executable-code-obfuscation.md | 9 +++++---- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index ab0e8c2..69f00aa 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -17,17 +17,20 @@ Disassembler Evasion ==================== -Malware code evades disassembly in a recursive or linear disassembler. Some methods apply to both types of disassemblers; others apply to one type and not the other. +Malware code evades disassembly in a recursive (flow-oriented) or linear disassembler, resulting in inaccurate or incomplete disassembly. The Disassembler Evasion behavior may also result in the disassembly process halting with an error. + +Some methods apply to both types of disassemblers; others apply to one type and not the other. Methods ------- |Name|ID|Description| |---|---|---| -|**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.| -|**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).| +|**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult and inaccurate.| +|**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; may be identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).| +|**Desynchronizing Opaque Predicates**|B0012.005|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[5]](#5)| |**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.| |**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often many times in the same basic block or function.| -|**Variable Recomposition**|B0012.004|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.| +|**Variable Recomposition**|B0012.004|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use, which can cause problems for linear disassemblers.| References ---------- @@ -38,3 +41,5 @@ References [3] https://isc.sans.edu/diary/Malicious+VBA+Office+Document+Without+Source+Code/24870 [4] https://boingboing.net/2019/05/05/p-code-r-us.html + +[5] https://www.ndss-symposium.org/wp-content/uploads/2020/04/bar2020-23004-paper.pdf diff --git a/anti-static-analysis/executable-code-obfuscation.md b/anti-static-analysis/executable-code-obfuscation.md index 1102870..8143806 100644 --- a/anti-static-analysis/executable-code-obfuscation.md +++ b/anti-static-analysis/executable-code-obfuscation.md @@ -17,7 +17,7 @@ Executable Code Obfuscation =========================== -Executable code can be obfuscated to hinder disassembly and static code analysis. This behavior is specific to a malware sample's executable code (data and text sections). +Executable code can be obfuscated to hinder static code analysis. This behavior is specific to a malware sample's executable code (data and text sections). While the Executable Code Obfuscation behavior makes the analysis process more difficult, it does not does cause incorrect disassembly, which is how it differs from the Disassembler Evasion behavior. For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware-sample files and information, see **Obfuscated Files or Information ([E1027](../defense-evasion/obfuscated-files-or-information.md))**. @@ -26,9 +26,9 @@ Methods |Name|ID|Description| |---|---|---| |**API Hashing**|B0032.001|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)| -|**Code Insertion**|B0032.002|Insert code to impede disassembly.| +|**Code Insertion**|B0032.002|Insert code to impede disassembly and make analysis more difficult.| |**Data Value Obfuscation**|B0032.008|Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*. [NEEDS REVIEW]| -|**Dead Code Insertion**|B0032.003|Include "dead" code with no real functionality.| +|**Dead Code Insertion**|B0032.003|Include "dead" code with no real functionality. When executing, malware may skip over such code via an opaque predicate.| |**Entry Point Obfuscation**|B0032.009|Obfuscate the entry point of the malware executable.| |**Fake Code Insertion**|B0032.004|Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.| |**Guard Pages**|B0032.010|Encrypt blocks of code individually and decrypt temporarily only upon execution.| @@ -39,8 +39,9 @@ Methods |**Jump Insertion**|B0032.005|Insert jumps to make analysis visually harder.| |**Junk Code Insertion**|B0032.007|Insert dummy code between relevant opcodes. Can make signature writing more complex.| |**Merged Code Sections**|B0032.015|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.| +|**Opaque Predicate**|B0032.019|An opaque predicate either always jumps (jumping over dead or junk code) or never jumps (executing essential code).| |**Stack Strings**|B0032.017|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.| -|**Structured Exception Handling (SEH)**|B0032.016|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).| +|**Structured Exception Handling (SEH)**|B0032.016|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).| |**Symbol Obfuscation**|B0032.018|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.| |**Thunk Code Insertion**|B0032.006|Variation on Jump Insertion. Used by some compilers for user-generated functions.| From ba0c30cda243492a6d3018a4205886c1b22640cb Mon Sep 17 00:00:00 2001 From: Dez Beck Date: Sun, 20 Nov 2022 15:08:42 -0500 Subject: [PATCH 2/5] address issue #67 --- anti-static-analysis/executable-code-obfuscation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/anti-static-analysis/executable-code-obfuscation.md b/anti-static-analysis/executable-code-obfuscation.md index 8143806..6f8bf54 100644 --- a/anti-static-analysis/executable-code-obfuscation.md +++ b/anti-static-analysis/executable-code-obfuscation.md @@ -35,7 +35,7 @@ Methods |**Import Address Table Obfuscation**|B0032.011|Obfuscate the import address table.| |**Import Compression**|B0032.012|Store and load imports with a compact import table format. Each DLL needed by the executable is mentioned in the IAT, but only one function from each/most is imported; the rest are imported via GetProcAddress calls.| |**Instruction Overlap**|B0032.013|Jump after the first byte of an instruction to confuse disassembler.| -|**Interleaving Code**|B0032.014|Split code into sections that may be rearranged and are connected by unconditional jumps.| +|**Interleaving Code**|B0032.014|Split code into sections that may be rearranged and may be connected by unconditional jumps. When instructions are out of order, writing a function signature is more difficult.| |**Jump Insertion**|B0032.005|Insert jumps to make analysis visually harder.| |**Junk Code Insertion**|B0032.007|Insert dummy code between relevant opcodes. Can make signature writing more complex.| |**Merged Code Sections**|B0032.015|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.| From 1eb1d399d6a879baf3e1a60b3ce58bb7555ba99b Mon Sep 17 00:00:00 2001 From: Dez Beck Date: Sun, 20 Nov 2022 15:40:03 -0500 Subject: [PATCH 3/5] update text for issues #63 and #65 --- anti-static-analysis/disassembler-evasion.md | 2 +- anti-static-analysis/executable-code-obfuscation.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index 69f00aa..0394de6 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -30,7 +30,7 @@ Methods |**Desynchronizing Opaque Predicates**|B0012.005|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[5]](#5)| |**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.| |**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often many times in the same basic block or function.| -|**Variable Recomposition**|B0012.004|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use, which can cause problems for linear disassemblers.| +|**Variable Recomposition**|B0012.004|Variables, often strings, are broken into multiple parts and stored out of order, in different memory ranges, or both. They must then be recomposed before use, which can cause problems for linear disassemblers.| References ---------- diff --git a/anti-static-analysis/executable-code-obfuscation.md b/anti-static-analysis/executable-code-obfuscation.md index 6f8bf54..0523538 100644 --- a/anti-static-analysis/executable-code-obfuscation.md +++ b/anti-static-analysis/executable-code-obfuscation.md @@ -17,7 +17,7 @@ Executable Code Obfuscation =========================== -Executable code can be obfuscated to hinder static code analysis. This behavior is specific to a malware sample's executable code (data and text sections). While the Executable Code Obfuscation behavior makes the analysis process more difficult, it does not does cause incorrect disassembly, which is how it differs from the Disassembler Evasion behavior. +Executable code can be obfuscated to hinder static code analysis. This behavior is specific to a malware sample's executable code (data and text sections). While the Executable Code Obfuscation behavior makes the analysis process more difficult, it does not does cause incorrect or incomplete disassembly, which is how it differs from the Disassembler Evasion behavior. For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware-sample files and information, see **Obfuscated Files or Information ([E1027](../defense-evasion/obfuscated-files-or-information.md))**. @@ -39,7 +39,7 @@ Methods |**Jump Insertion**|B0032.005|Insert jumps to make analysis visually harder.| |**Junk Code Insertion**|B0032.007|Insert dummy code between relevant opcodes. Can make signature writing more complex.| |**Merged Code Sections**|B0032.015|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.| -|**Opaque Predicate**|B0032.019|An opaque predicate either always jumps (jumping over dead or junk code) or never jumps (executing essential code).| +|**Opaque Predicate**|B0032.019|An opaque predicate either always jumps (jumping over dead or junk code) or never jumps (executing essential code), but determining the execution path can be difficult.| |**Stack Strings**|B0032.017|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.| |**Structured Exception Handling (SEH)**|B0032.016|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).| |**Symbol Obfuscation**|B0032.018|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.| From 78694e454fb7273e073e209afbcac51b73e58341 Mon Sep 17 00:00:00 2001 From: Dez Beck Date: Mon, 21 Nov 2022 22:21:30 -0500 Subject: [PATCH 4/5] move methods between behaviors --- anti-static-analysis/disassembler-evasion.md | 4 +--- anti-static-analysis/executable-code-obfuscation.md | 5 +++-- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index 0394de6..a7d9573 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -25,12 +25,10 @@ Methods ------- |Name|ID|Description| |---|---|---| -|**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult and inaccurate.| |**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; may be identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).| -|**Desynchronizing Opaque Predicates**|B0012.005|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[5]](#5)| +|**Desynchronizing Opaque Predicates**|B0012.006|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[5]](#5)| |**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.| |**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often many times in the same basic block or function.| -|**Variable Recomposition**|B0012.004|Variables, often strings, are broken into multiple parts and stored out of order, in different memory ranges, or both. They must then be recomposed before use, which can cause problems for linear disassemblers.| References ---------- diff --git a/anti-static-analysis/executable-code-obfuscation.md b/anti-static-analysis/executable-code-obfuscation.md index 0523538..9f4e3e6 100644 --- a/anti-static-analysis/executable-code-obfuscation.md +++ b/anti-static-analysis/executable-code-obfuscation.md @@ -17,7 +17,7 @@ Executable Code Obfuscation =========================== -Executable code can be obfuscated to hinder static code analysis. This behavior is specific to a malware sample's executable code (data and text sections). While the Executable Code Obfuscation behavior makes the analysis process more difficult, it does not does cause incorrect or incomplete disassembly, which is how it differs from the Disassembler Evasion behavior. +Executable code is obfuscated to hinder static code analysis. This behavior is specific to a malware sample's executable code (data and text sections). While the Executable Code Obfuscation behavior makes the analysis process more difficult, it does not cause incorrect or incomplete disassembly, which is how this behavior differs from the Disassembler Evasion behavior. For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware-sample files and information, see **Obfuscated Files or Information ([E1027](../defense-evasion/obfuscated-files-or-information.md))**. @@ -25,6 +25,7 @@ Methods ------- |Name|ID|Description| |---|---|---| +|**Argument Obfuscation**|B0032.020|Simple number or string arguments to API calls are calculated at runtime, making analysis more difficult.| |**API Hashing**|B0032.001|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)| |**Code Insertion**|B0032.002|Insert code to impede disassembly and make analysis more difficult.| |**Data Value Obfuscation**|B0032.008|Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*. [NEEDS REVIEW]| @@ -44,7 +45,7 @@ Methods |**Structured Exception Handling (SEH)**|B0032.016|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).| |**Symbol Obfuscation**|B0032.018|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.| |**Thunk Code Insertion**|B0032.006|Variation on Jump Insertion. Used by some compilers for user-generated functions.| - +|**Variable Recomposition**|B0032.021|Variables, often strings, are broken into multiple parts and stored out of order, in different memory ranges, or both. They must then be recomposed before use, making analysis difficult.| Malware Examples ---------------- From a59ccac398741a048766b672ffbb1c5536ee9d43 Mon Sep 17 00:00:00 2001 From: Dez Beck Date: Tue, 22 Nov 2022 09:58:17 -0500 Subject: [PATCH 5/5] move methods between behaviors --- anti-static-analysis/disassembler-evasion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index a7d9573..ade5070 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -28,7 +28,7 @@ Methods |**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; may be identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).| |**Desynchronizing Opaque Predicates**|B0012.006|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[5]](#5)| |**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.| -|**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often many times in the same basic block or function.| +|**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often in the same basic block or function.| References ----------