1 1 00:00:00,510 --> 00:00:02,328 Reverse engineering. 2 2 00:00:02,328 --> 00:00:05,070 What is reverse engineering? 3 3 00:00:05,070 --> 00:00:07,140 Well, reverse engineering is the process 4 4 00:00:07,140 --> 00:00:10,110 of analyzing the structure of hardware or software 5 5 00:00:10,110 --> 00:00:12,060 to reveal more about its functions. 6 6 00:00:12,060 --> 00:00:13,620 And in this lesson we're going to focus 7 7 00:00:13,620 --> 00:00:15,060 on that software part, 8 8 00:00:15,060 --> 00:00:17,730 specifically when we're talking about malware. 9 9 00:00:17,730 --> 00:00:19,530 Now, when I was talking about malware 10 10 00:00:19,530 --> 00:00:21,030 in the last lesson, we were talking about 11 11 00:00:21,030 --> 00:00:23,760 dynamic analysis where we would turn on a sandbox, 12 12 00:00:23,760 --> 00:00:26,760 we would install the malware, and let something happen, 13 13 00:00:26,760 --> 00:00:28,290 and then we would observe those effects. 14 14 00:00:28,290 --> 00:00:30,552 Well, another way to do this is by doing a static analysis 15 15 00:00:30,552 --> 00:00:33,090 by reverse engineering something. 16 16 00:00:33,090 --> 00:00:35,310 Now a malware reverse engineer can determine who 17 17 00:00:35,310 --> 00:00:38,790 actually wrote the code by starting to learn their patterns. 18 18 00:00:38,790 --> 00:00:40,620 Most people who code have their own style, 19 19 00:00:40,620 --> 00:00:41,970 their own way of writing. 20 20 00:00:41,970 --> 00:00:43,500 If you've ever read somebody's handwriting, 21 21 00:00:43,500 --> 00:00:44,910 you can look at it and over time 22 22 00:00:44,910 --> 00:00:47,790 start learning whose handwriting belongs with which person. 23 23 00:00:47,790 --> 00:00:49,380 Well, coders are much the same 24 24 00:00:49,380 --> 00:00:51,870 and as you start reading enough of somebody's code, 25 25 00:00:51,870 --> 00:00:54,450 you can start seeing exactly their processes 26 26 00:00:54,450 --> 00:00:55,890 and you start identifying this piece 27 27 00:00:55,890 --> 00:00:58,440 of malware with this particular person. 28 28 00:00:58,440 --> 00:01:00,237 And that's one of the benefits 29 29 00:01:00,237 --> 00:01:01,560 finding a strong malware reverse engineer 30 30 00:01:01,560 --> 00:01:03,270 working on your team if you're doing 31 31 00:01:03,270 --> 00:01:05,130 a lot of instant response or you're working 32 32 00:01:05,130 --> 00:01:07,500 for a threat intelligence gathering agency. 33 33 00:01:07,500 --> 00:01:09,690 Now as you reverse engineering malware, 34 34 00:01:09,690 --> 00:01:13,050 some malware is easier to reverse engineer than others. 35 35 00:01:13,050 --> 00:01:15,660 For example, if you're using something like Java, 36 36 00:01:15,660 --> 00:01:17,550 this can be easily decompiled back 37 37 00:01:17,550 --> 00:01:19,770 into the source code that looks like this. 38 38 00:01:19,770 --> 00:01:22,290 Once you have the source code, you can then understand 39 39 00:01:22,290 --> 00:01:24,630 what's being done inside the malware and then you can 40 40 00:01:24,630 --> 00:01:26,730 figure out better ways to block this malware 41 41 00:01:26,730 --> 00:01:29,160 and prevent it from doing any damage to your systems. 42 42 00:01:29,160 --> 00:01:30,720 Now, unfortunately not all malware 43 43 00:01:30,720 --> 00:01:31,950 is easy to read and dissect 44 44 00:01:31,950 --> 00:01:33,360 like this Java code. 45 45 00:01:33,360 --> 00:01:35,100 A lot of malware writers will actually 46 46 00:01:35,100 --> 00:01:38,130 obfuscate their code before it's assembled or compiled 47 47 00:01:38,130 --> 00:01:41,010 to prevent analysis by a reverse engineer. 48 48 00:01:41,010 --> 00:01:44,010 This makes it convoluted and very non-straightforward 49 49 00:01:44,010 --> 00:01:45,570 in the way that somebody could read it 50 50 00:01:45,570 --> 00:01:47,370 and this makes your job much harder 51 51 00:01:47,370 --> 00:01:49,050 if you're a reverse engineer. 52 52 00:01:49,050 --> 00:01:50,160 Now there's a couple of tools 53 53 00:01:50,160 --> 00:01:51,810 that will help us with that though. 54 54 00:01:51,810 --> 00:01:53,610 For example, the first one is what we talked 55 55 00:01:53,610 --> 00:01:55,950 about in the last lesson, which was sandboxing. 56 56 00:01:55,950 --> 00:01:58,080 Whatever difficulty you may have when 57 57 00:01:58,080 --> 00:01:59,430 you're reverse engineering malware 58 58 00:01:59,430 --> 00:02:01,440 if you're doing it in a sandbox environment, 59 59 00:02:01,440 --> 00:02:04,410 it's going to have no impact on your production systems. 60 60 00:02:04,410 --> 00:02:06,296 This is especially necessary for malware 61 61 00:02:06,296 --> 00:02:08,580 when you're trying to detect what is being done 62 62 00:02:08,580 --> 00:02:10,650 as it's being deconstructed or run 63 63 00:02:10,650 --> 00:02:12,690 doing something in a more dynamic method. 64 64 00:02:12,690 --> 00:02:14,490 Now, when you start doing things statically, 65 65 00:02:14,490 --> 00:02:16,530 you have to actually get to the code 66 66 00:02:16,530 --> 00:02:18,420 and we use a couple of tools to do this. 67 67 00:02:18,420 --> 00:02:20,700 The first one is known as a disassembler. 68 68 00:02:20,700 --> 00:02:23,580 Now, a disassembler is a computer program that translates 69 69 00:02:23,580 --> 00:02:26,670 that machine language into assembly language. 70 70 00:02:26,670 --> 00:02:29,160 Now, machine code when we talk about machine language 71 71 00:02:29,160 --> 00:02:32,580 is simply the binary code that's executed by your processor. 72 72 00:02:32,580 --> 00:02:35,970 Typically it's represented by two hex digits for each byte 73 73 00:02:35,970 --> 00:02:39,090 and each byte is eight ones and zeros. 74 74 00:02:39,090 --> 00:02:40,560 Now what does this look like? 75 75 00:02:40,560 --> 00:02:43,590 Well, here on the screen you can see the memory view 76 76 00:02:43,590 --> 00:02:46,500 and I have that six F highlighted in blue. 77 77 00:02:46,500 --> 00:02:48,510 That is the first byte that we're looking at 78 78 00:02:48,510 --> 00:02:50,430 at that particular memory location. 79 79 00:02:50,430 --> 00:02:53,730 That is a two digit hex code that translates to a series 80 80 00:02:53,730 --> 00:02:56,370 of ones and zeros, and that tells the computer 81 81 00:02:56,370 --> 00:02:59,370 what it should be doing based on that instruction code. 82 82 00:02:59,370 --> 00:03:01,710 Now as a human though, that doesn't mean much to me. 83 83 00:03:01,710 --> 00:03:04,140 Those codes are very difficult to read 84 84 00:03:04,140 --> 00:03:05,400 and if I have a whole screen filled 85 85 00:03:05,400 --> 00:03:07,680 with those type of hex digits, it'd be very hard 86 86 00:03:07,680 --> 00:03:10,080 for me to figure out exactly what that program's doing. 87 87 00:03:10,080 --> 00:03:11,730 Now there are a couple of hex codes 88 88 00:03:11,730 --> 00:03:13,500 that are important for you to know though 89 89 00:03:13,500 --> 00:03:16,890 and these are known as file signatures or magic numbers. 90 90 00:03:16,890 --> 00:03:19,110 Now a magic number is the first two bytes 91 91 00:03:19,110 --> 00:03:21,951 of a binary header and it indicates the file type. 92 92 00:03:21,951 --> 00:03:25,440 This is basically going to tell you what type of file it is. 93 93 00:03:25,440 --> 00:03:28,297 So when I look at a file, like an image file 94 94 00:03:28,297 --> 00:03:29,520 and I see dot png at the end, 95 95 00:03:29,520 --> 00:03:31,440 that tells me it's a graphics file, 96 96 00:03:31,440 --> 00:03:34,830 but an attacker doesn't have to put PNG at the end. 97 97 00:03:34,830 --> 00:03:37,230 They can change that to EXE or something else 98 98 00:03:37,230 --> 00:03:39,540 and you really won't know what type of file it is. 99 99 00:03:39,540 --> 00:03:42,150 If you look at the first two bytes of that file though, 100 100 00:03:42,150 --> 00:03:44,664 it will always tell you what that file is 101 101 00:03:44,664 --> 00:03:46,080 and that's what we're talking about, this magic number. 102 102 00:03:46,080 --> 00:03:47,928 If you want to look these up, 103 103 00:03:47,928 --> 00:03:49,230 you can go to file signatures.net 104 104 00:03:49,230 --> 00:03:51,450 and there's a whole database for all of them. 105 105 00:03:51,450 --> 00:03:54,750 So look at the first two to four hex digits inside the file. 106 106 00:03:54,750 --> 00:03:56,520 Look it up at filesignatures.net 107 107 00:03:56,520 --> 00:03:58,110 and you'll know exactly what it is 108 108 00:03:58,110 --> 00:04:00,540 because even if I change the extension to dot PNG 109 109 00:04:00,540 --> 00:04:02,070 but it's an executable, 110 110 00:04:02,070 --> 00:04:05,280 it's going to have the correct file signature on it. 111 111 00:04:05,280 --> 00:04:07,170 For instance, when you're reading the first two bytes 112 112 00:04:07,170 --> 00:04:09,300 of a Windows portable executable file, 113 113 00:04:09,300 --> 00:04:11,693 whether it's an EXE, a DLL, 114 114 00:04:11,693 --> 00:04:14,910 an SYS, a DRV, or a com file, 115 115 00:04:14,910 --> 00:04:16,440 they're always going to start with 116 116 00:04:16,440 --> 00:04:19,830 the hex digits of four D five A. 117 117 00:04:19,830 --> 00:04:23,070 That says this is a Windows portable executable file. 118 118 00:04:23,070 --> 00:04:24,300 So even if I rename that file 119 119 00:04:24,300 --> 00:04:26,943 and put JPG at the end or dot DOC, 120 120 00:04:27,780 --> 00:04:29,520 it still would execute because of 121 121 00:04:29,520 --> 00:04:31,563 that four D five A, and it knows 122 122 00:04:31,563 --> 00:04:34,440 that that is a Windows portable executable file. 123 123 00:04:34,440 --> 00:04:36,480 Attackers use this against you all the time, 124 124 00:04:36,480 --> 00:04:37,470 so this is one of those ones 125 125 00:04:37,470 --> 00:04:39,630 that you should know for the real world. 126 126 00:04:39,630 --> 00:04:42,930 Now if you translate that into ASCII, that's MZ 127 127 00:04:42,930 --> 00:04:46,470 and if you translate this into Base64 encoding, it's TV. 128 128 00:04:46,470 --> 00:04:49,260 So anytime you see any of those three codes there 129 129 00:04:49,260 --> 00:04:51,780 that tells you this is an executable file. 130 130 00:04:51,780 --> 00:04:53,940 Now the next step up from machine code 131 131 00:04:53,940 --> 00:04:55,530 is going to be assembly code. 132 132 00:04:55,530 --> 00:04:56,760 Where machine code is written 133 133 00:04:56,760 --> 00:04:58,890 in ones and zeros or hex digits, 134 134 00:04:58,890 --> 00:04:59,910 assembly code is written 135 135 00:04:59,910 --> 00:05:02,370 in something that's more human readable. 136 136 00:05:02,370 --> 00:05:04,500 Now this is the native processor instruction 137 137 00:05:04,500 --> 00:05:06,720 set that's used to implement a program. 138 138 00:05:06,720 --> 00:05:07,710 In the old days, we used 139 139 00:05:07,710 --> 00:05:10,230 to actually write programs inside assembly, 140 140 00:05:10,230 --> 00:05:13,350 but nowadays that is also a little bit hard to do. 141 141 00:05:13,350 --> 00:05:14,940 So if we look here at the next screen, 142 142 00:05:14,940 --> 00:05:16,170 you can see up at the top 143 143 00:05:16,170 --> 00:05:18,390 I've highlighted the first two lines 144 144 00:05:18,390 --> 00:05:20,460 of that hex machine code. 145 145 00:05:20,460 --> 00:05:21,990 Now, if you see a highlight at the bottom 146 146 00:05:21,990 --> 00:05:23,430 in the disassembly section, 147 147 00:05:23,430 --> 00:05:26,400 this is that same hex codes from the top. 148 148 00:05:26,400 --> 00:05:28,680 Again, not very easy for us to read, 149 149 00:05:28,680 --> 00:05:30,630 but if I look over to the right side, 150 150 00:05:30,630 --> 00:05:32,760 you will see the assembly code. 151 151 00:05:32,760 --> 00:05:34,230 Now, this is more human readable. 152 152 00:05:34,230 --> 00:05:36,000 You can read this, I see move, 153 153 00:05:36,000 --> 00:05:37,620 which tells me I'm probably moving stuff 154 154 00:05:37,620 --> 00:05:39,570 from one register of the memory to another. 155 155 00:05:39,570 --> 00:05:42,240 I have push, which says I'm putting something into memory. 156 156 00:05:42,240 --> 00:05:44,820 I'm calling, I'm pulling things from memory. 157 157 00:05:44,820 --> 00:05:47,400 These aren't necessarily the easiest things to read, 158 158 00:05:47,400 --> 00:05:49,980 but it is still something that a human can read. 159 159 00:05:49,980 --> 00:05:51,630 And back in the seventies and eighties, 160 160 00:05:51,630 --> 00:05:52,920 a lot of our computer programs 161 161 00:05:52,920 --> 00:05:55,080 were written straight in assembly. 162 162 00:05:55,080 --> 00:05:57,910 Now to get to assembly, we use a decompiler 163 163 00:05:57,910 --> 00:06:00,900 and a decompiler is software that translates a binary 164 164 00:06:00,900 --> 00:06:04,590 or low level machine language into a higher level language. 165 165 00:06:04,590 --> 00:06:07,500 So if I take the binary and I move it to assembly, 166 166 00:06:07,500 --> 00:06:10,500 a decompiler can do that or a disassembler can do that. 167 167 00:06:10,500 --> 00:06:13,200 Now, once I have that, I can put it through a decompiler 168 168 00:06:13,200 --> 00:06:15,030 and get it to a higher level code. 169 169 00:06:15,030 --> 00:06:17,310 Now, when I talk about a higher level code, 170 170 00:06:17,310 --> 00:06:18,360 what is that really? 171 171 00:06:18,360 --> 00:06:21,270 Well, high level code is real or pseudo code 172 172 00:06:21,270 --> 00:06:23,610 in human readable form that makes it easier 173 173 00:06:23,610 --> 00:06:26,790 to identify functions, variables, programming logic 174 174 00:06:26,790 --> 00:06:28,370 and other things like that that are used in the code. 175 175 00:06:28,370 --> 00:06:30,570 Now, when I talk about a higher level code, 176 176 00:06:30,570 --> 00:06:32,227 I'm talking about things like C 177 177 00:06:32,227 --> 00:06:36,060 or basic or Java or something like that. 178 178 00:06:36,060 --> 00:06:37,170 Those are all languages that 179 179 00:06:37,170 --> 00:06:38,850 if I gave you some script from that, 180 180 00:06:38,850 --> 00:06:40,680 you could probably figure out what's going on 181 181 00:06:40,680 --> 00:06:43,620 just by reading it 'cause it reads similar to English 182 182 00:06:43,620 --> 00:06:46,590 not like assembly, and definitely not like machine language. 183 183 00:06:46,590 --> 00:06:48,510 Now, let's take a look here on the screen. 184 184 00:06:48,510 --> 00:06:51,150 Here on the screen I have a program called IDA Pro, 185 185 00:06:51,150 --> 00:06:52,800 which is a famous decompiler. 186 186 00:06:52,800 --> 00:06:54,300 It takes the ones and zeros, 187 187 00:06:54,300 --> 00:06:56,460 that binary and hex values, 188 188 00:06:56,460 --> 00:06:58,440 translates it into assembly language 189 189 00:06:58,440 --> 00:07:00,510 by doing a disassembly function, 190 190 00:07:00,510 --> 00:07:03,000 and then it can take that disassembly function and run it 191 191 00:07:03,000 --> 00:07:05,730 through a decompiler and come up with this pseudo code. 192 192 00:07:05,730 --> 00:07:08,340 Now, this code is not what the original programmer wrote, 193 193 00:07:08,340 --> 00:07:10,080 but this is an equivalent program 194 194 00:07:10,080 --> 00:07:11,550 that would do the functions 195 195 00:07:11,550 --> 00:07:12,990 of what that person wrote. 196 196 00:07:12,990 --> 00:07:14,640 And so this will allow us to go through 197 197 00:07:14,640 --> 00:07:16,290 as we're doing our reverse engineering 198 198 00:07:16,290 --> 00:07:17,700 and understand a little bit more 199 199 00:07:17,700 --> 00:07:19,680 than using something like assembly. 200 200 00:07:19,680 --> 00:07:23,460 Now, some languages like Java have their own decompilers 201 201 00:07:23,460 --> 00:07:24,810 and they can take it from the ones 202 202 00:07:24,810 --> 00:07:26,700 and zeros all the way back up 203 203 00:07:26,700 --> 00:07:28,680 to something that looks like real Java. 204 204 00:07:28,680 --> 00:07:30,270 As you could see here on the screen, 205 205 00:07:30,270 --> 00:07:32,490 this is an example of a Java decompiler 206 206 00:07:32,490 --> 00:07:34,560 and we've taken this binary class file 207 207 00:07:34,560 --> 00:07:36,210 and it's gone through and brought it back 208 208 00:07:36,210 --> 00:07:39,510 into the text where it's very easy for you and I to read it. 209 209 00:07:39,510 --> 00:07:41,160 Now, why do we care about getting 210 210 00:07:41,160 --> 00:07:43,590 all this stuff back to a human readable form? 211 211 00:07:43,590 --> 00:07:45,210 Well, there's a couple of reasons. 212 212 00:07:45,210 --> 00:07:47,160 One is we can figure out what logic is being used 213 213 00:07:47,160 --> 00:07:49,500 inside this malware and what functions it's doing 214 214 00:07:49,500 --> 00:07:51,900 and another is to identify strings because 215 215 00:07:51,900 --> 00:07:53,700 as a reverse engineer, we want to attempt 216 216 00:07:53,700 --> 00:07:55,860 to identify malware by finding strings 217 217 00:07:55,860 --> 00:07:58,530 to use for signature-based rule detection. 218 218 00:07:58,530 --> 00:08:00,390 Now, by doing that, we can identify 219 219 00:08:00,390 --> 00:08:02,700 these different strings from the code, 220 220 00:08:02,700 --> 00:08:04,140 we can put that into our rules, 221 221 00:08:04,140 --> 00:08:05,730 and then we can flag that and alert 222 222 00:08:05,730 --> 00:08:08,040 on that when malware tries to attack us. 223 223 00:08:08,040 --> 00:08:09,300 Now, when I talk about a string, 224 224 00:08:09,300 --> 00:08:10,980 a string is simply any sequence 225 225 00:08:10,980 --> 00:08:12,870 of encoded characters that appears 226 226 00:08:12,870 --> 00:08:14,460 within the executable file. 227 227 00:08:14,460 --> 00:08:16,800 These strings can be lots of different things. 228 228 00:08:16,800 --> 00:08:19,410 You can find things like ASCII sequences 229 229 00:08:19,410 --> 00:08:22,380 that contain usernames, or passwords, 230 230 00:08:22,380 --> 00:08:25,350 or file names, or function calls, 231 231 00:08:25,350 --> 00:08:27,390 or even things like a URL. 232 232 00:08:27,390 --> 00:08:29,520 For instance, if a malware contains a string 233 233 00:08:29,520 --> 00:08:32,280 with a function called InternetOpenUrl 234 234 00:08:32,280 --> 00:08:34,440 and another string that says URL, 235 235 00:08:34,440 --> 00:08:36,000 you probably can guess that's trying 236 236 00:08:36,000 --> 00:08:37,170 to attempt to download something 237 237 00:08:37,170 --> 00:08:39,180 from that web address as part of the malware. 238 238 00:08:39,180 --> 00:08:40,260 Maybe this is a dropper, 239 239 00:08:40,260 --> 00:08:42,300 it's going to download some second stage malware 240 240 00:08:42,300 --> 00:08:43,830 by going to this URL. 241 241 00:08:43,830 --> 00:08:46,165 Now, there's a tool that you can use 242 242 00:08:46,165 --> 00:08:47,714 to dump these strings very easily 243 243 00:08:47,714 --> 00:08:49,110 without having to go through all the reverse engineering. 244 244 00:08:49,110 --> 00:08:51,600 It's called strings and the strings tool 245 245 00:08:51,600 --> 00:08:53,130 will dump all the strings that are 246 246 00:08:53,130 --> 00:08:56,370 over three characters in ASCII or unicode encoding 247 247 00:08:56,370 --> 00:08:58,230 to a text file or to your screen 248 248 00:08:58,230 --> 00:09:01,020 so you can then look at it and analyze it yourself. 249 249 00:09:01,020 --> 00:09:02,880 Now, the one problem when you're using strings is 250 250 00:09:02,880 --> 00:09:05,850 that it will find anything that is over three characters, 251 251 00:09:05,850 --> 00:09:08,550 which means it can find a lot of garbage too. 252 252 00:09:08,550 --> 00:09:10,590 When I run this, when I'm doing malware analysis 253 253 00:09:10,590 --> 00:09:11,820 and I'm going to show you a demonstration 254 254 00:09:11,820 --> 00:09:14,531 of this later in the course, you will see 255 255 00:09:14,531 --> 00:09:16,045 that a lot of the stuff that it outputs 256 256 00:09:16,045 --> 00:09:17,340 to us is stuff that just looks like gobbledygook. 257 257 00:09:17,340 --> 00:09:19,200 It's something you can't even see, 258 258 00:09:19,200 --> 00:09:21,960 but you'll also find some valuable things in there too. 259 259 00:09:21,960 --> 00:09:22,830 And so that's why we still 260 260 00:09:22,830 --> 00:09:24,728 run strings against malware samples. 261 261 00:09:24,728 --> 00:09:26,970 Now, the next tool we want to talk about 262 262 00:09:26,970 --> 00:09:30,570 in our reverse engineering of malware is program packers. 263 263 00:09:30,570 --> 00:09:32,970 Now, malware can use a program packer, 264 264 00:09:32,970 --> 00:09:34,800 which is a method of compression in which 265 265 00:09:34,800 --> 00:09:37,140 the executable is mostly compressed 266 266 00:09:37,140 --> 00:09:39,120 and the part that isn't compressed basically 267 267 00:09:39,120 --> 00:09:41,520 just contains code to decompress the executable. 268 268 00:09:41,520 --> 00:09:43,350 Essentially, a pack program is a type 269 269 00:09:43,350 --> 00:09:45,240 of self extracting archive. 270 270 00:09:45,240 --> 00:09:46,440 Now, there are a couple of reasons 271 271 00:09:46,440 --> 00:09:49,290 that malware writers use these pack programs. 272 272 00:09:49,290 --> 00:09:51,720 One is that it makes the file size a lot smaller 273 273 00:09:51,720 --> 00:09:53,850 so it's easier to transmit this malware. 274 274 00:09:53,850 --> 00:09:55,470 And the second is it makes it harder 275 275 00:09:55,470 --> 00:09:58,380 for us as reverse engineers to see the files content 276 276 00:09:58,380 --> 00:10:01,290 because we have to unpack it first before we can see it. 277 277 00:10:01,290 --> 00:10:04,440 This is another way that they do this to obfuscate things. 278 278 00:10:04,440 --> 00:10:05,730 Now, some people think, 279 279 00:10:05,730 --> 00:10:08,070 well, anything that's packed must be bad, right? 280 280 00:10:08,070 --> 00:10:09,510 So I'm just going to block it all. 281 281 00:10:09,510 --> 00:10:10,947 Well, not necessarily. 282 282 00:10:10,947 --> 00:10:13,805 A lot of organizations who share proprietary software 283 283 00:10:13,805 --> 00:10:16,170 will use program packing to deter theft 284 284 00:10:16,170 --> 00:10:18,125 of intellectual property and 285 285 00:10:18,125 --> 00:10:19,350 copyright violations and piracy. 286 286 00:10:19,350 --> 00:10:22,072 So you can't just block every program that's packed 287 287 00:10:22,072 --> 00:10:24,300 because it doesn't necessarily mean it's malicious, 288 288 00:10:24,300 --> 00:10:25,770 but a lot of them are. 289 289 00:10:25,770 --> 00:10:27,930 So you have to think about this as you're going through 290 290 00:10:27,930 --> 00:10:29,250 and developing your signatures, 291 291 00:10:29,250 --> 00:10:30,720 and you can't just automatically assume 292 292 00:10:30,720 --> 00:10:32,670 a pack program equals malware. 293 293 00:10:32,670 --> 00:10:34,710 This would lead to a lot of false positives 294 294 00:10:34,710 --> 00:10:36,630 and it could have a lot of bad effects 295 295 00:10:36,630 --> 00:10:37,920 inside your operations if you 296 296 00:10:37,920 --> 00:10:39,390 block everything that's packed. 297 297 00:10:39,390 --> 00:10:42,090 So what do you do if you have a piece of packed malware? 298 298 00:10:42,090 --> 00:10:43,800 Well, first you're going to unpack it 299 299 00:10:43,800 --> 00:10:46,710 before you can analyze it because until it is unpacked, 300 300 00:10:46,710 --> 00:10:48,990 packed malware can mask literal strings 301 301 00:10:48,990 --> 00:10:50,970 and effectively modify its signatures 302 302 00:10:50,970 --> 00:10:53,340 to avoid triggering signature based scanners 303 303 00:10:53,340 --> 00:10:54,570 and this is why you're going to have 304 304 00:10:54,570 --> 00:10:56,130 to use this as one of your steps. 305 305 00:10:56,130 --> 00:10:57,480 So you'll unpack the malware 306 306 00:10:57,480 --> 00:10:59,520 and then perform your analysis on it. 307 307 00:10:59,520 --> 00:11:00,990 In fact, when I do malware analysis, 308 308 00:11:00,990 --> 00:11:04,110 we actually will do the analysis on the pack program first 309 309 00:11:04,110 --> 00:11:07,230 and then we will do it again once we unpack the program 310 310 00:11:07,230 --> 00:11:09,780 because sometimes we can find different strings in there 311 311 00:11:09,780 --> 00:11:11,930 and use those to build our signature rules.