1
00:00:06,510 --> 00:00:07,890
- [Instructor] In this
Closer Look segment,

2
00:00:07,890 --> 00:00:10,473
we're gonna focus on analyzing malware.

3
00:00:10,473 --> 00:00:11,970
Now, I want you to imagine

4
00:00:11,970 --> 00:00:13,272
that you're faced with a situation

5
00:00:13,272 --> 00:00:16,140
where you suspect a file is malicious,

6
00:00:16,140 --> 00:00:19,050
but the antivirus isn't
tagging it as such.

7
00:00:19,050 --> 00:00:20,370
What can you do?

8
00:00:20,370 --> 00:00:22,020
Well, one option is to join

9
00:00:22,020 --> 00:00:24,420
thousands of professionals
around the world

10
00:00:24,420 --> 00:00:26,400
who submit files for analysis.

11
00:00:26,400 --> 00:00:29,880
And one of the most popular
malware analysis services

12
00:00:29,880 --> 00:00:31,280
is VirusTotal.

13
00:00:32,181 --> 00:00:34,770
Now VirusTotal is owned by Chronicle,

14
00:00:34,770 --> 00:00:37,350
which is a subsidiary of Alphabet

15
00:00:37,350 --> 00:00:39,450
that we know better as Google.

16
00:00:39,450 --> 00:00:42,180
Now, this is a really easy service to use.

17
00:00:42,180 --> 00:00:44,040
If you wanna submit a file,

18
00:00:44,040 --> 00:00:47,400
you can just browse for the
file, and send it right up.

19
00:00:47,400 --> 00:00:49,350
Now we're gonna submit a malware sample.

20
00:00:49,350 --> 00:00:50,730
It's not really malware,

21
00:00:50,730 --> 00:00:54,240
it's just made to look like
it might be a malware file.

22
00:00:54,240 --> 00:00:56,220
And let's see how it's detected.

23
00:00:56,220 --> 00:00:57,780
So I'm gonna choose a file.

24
00:00:57,780 --> 00:01:00,330
I'm gonna choose this AV Test file.

25
00:01:00,330 --> 00:01:01,770
I'm gonna send it up,

26
00:01:01,770 --> 00:01:03,840
and right away I have 41 engines

27
00:01:03,840 --> 00:01:06,640
who have returned
information about the file,

28
00:01:06,640 --> 00:01:08,790
and they're coming back telling me

29
00:01:08,790 --> 00:01:11,880
that it's an EICAR test
file, that it's not a virus.

30
00:01:11,880 --> 00:01:13,470
That's what most of them are telling me.

31
00:01:13,470 --> 00:01:16,080
So what's an EICAR antivirus test file?

32
00:01:16,080 --> 00:01:17,851
Well, the test file is a computer file

33
00:01:17,851 --> 00:01:19,590
that was actually developed by

34
00:01:19,590 --> 00:01:23,250
the European Institute for
Computer Antivirus Research.

35
00:01:23,250 --> 00:01:24,357
That's the EICAR,

36
00:01:24,357 --> 00:01:28,170
and the Computer Antivirus
Research Organization, CARO,

37
00:01:28,170 --> 00:01:31,170
to test the response of
computer AV programs.

38
00:01:31,170 --> 00:01:32,880
So instead of using real malware,

39
00:01:32,880 --> 00:01:34,870
which would cause, well, real damage,

40
00:01:34,870 --> 00:01:36,660
this test file allows people

41
00:01:36,660 --> 00:01:38,880
to test their antivirus software

42
00:01:38,880 --> 00:01:42,870
without having to use
a real computer virus.

43
00:01:42,870 --> 00:01:44,820
In this case, these engines,

44
00:01:44,820 --> 00:01:46,530
the majority of them all detected

45
00:01:46,530 --> 00:01:49,623
that this was actually an EICAR test file.

46
00:01:51,240 --> 00:01:54,120
We know very often when
we're working with malware,

47
00:01:54,120 --> 00:01:55,860
we don't actually wanna interact

48
00:01:55,860 --> 00:01:58,200
with the actual malicious file, right?

49
00:01:58,200 --> 00:01:59,310
We don't wanna copy it,

50
00:01:59,310 --> 00:02:00,960
we don't wanna move it around,

51
00:02:00,960 --> 00:02:02,550
we don't wanna install it.

52
00:02:02,550 --> 00:02:05,040
So another way to get information

53
00:02:05,040 --> 00:02:06,720
is to take a hash of the file

54
00:02:06,720 --> 00:02:08,790
to create that representation,

55
00:02:08,790 --> 00:02:12,060
and then send the hash up for analysis.

56
00:02:12,060 --> 00:02:13,533
So let's do that next.

57
00:02:14,670 --> 00:02:16,053
I'm coming over to search,

58
00:02:17,190 --> 00:02:20,043
and I am pasting in a hash.

59
00:02:24,360 --> 00:02:25,620
And what am I gonna get back?

60
00:02:25,620 --> 00:02:28,890
Well, I'm told that 40
engines detected this file

61
00:02:28,890 --> 00:02:32,310
as being malicious, based
on the hash that I inputted.

62
00:02:32,310 --> 00:02:34,410
You can see everything from suspicious,

63
00:02:34,410 --> 00:02:36,930
to giving me information
that it's a Trojan,

64
00:02:36,930 --> 00:02:39,360
to giving me malicious scores,

65
00:02:39,360 --> 00:02:41,490
to telling me that there's
multiple detections.

66
00:02:41,490 --> 00:02:43,650
I can see all of these various engines

67
00:02:43,650 --> 00:02:46,770
that are coming back and
giving me more information

68
00:02:46,770 --> 00:02:49,080
related to that file.

69
00:02:49,080 --> 00:02:51,570
Now, interestingly, they
have different names,

70
00:02:51,570 --> 00:02:53,400
and that's because different engines

71
00:02:53,400 --> 00:02:56,520
and different antivirus publishers

72
00:02:56,520 --> 00:02:59,790
and researchers actually
assign different names

73
00:02:59,790 --> 00:03:02,550
to the same piece of malware.

74
00:03:02,550 --> 00:03:04,080
If I wanna get more information,

75
00:03:04,080 --> 00:03:07,380
I can go to details, get
that basic properties,

76
00:03:07,380 --> 00:03:09,690
but also here I can look at history,

77
00:03:09,690 --> 00:03:12,480
first submission, last
submission, last analysis,

78
00:03:12,480 --> 00:03:14,640
earliest contents modification,

79
00:03:14,640 --> 00:03:16,620
latest contents modification.

80
00:03:16,620 --> 00:03:19,050
I can find out if this
file has been submitted

81
00:03:19,050 --> 00:03:23,130
under any other names or
any other hash sequences.

82
00:03:23,130 --> 00:03:26,250
I can get more information
about the file itself

83
00:03:26,250 --> 00:03:28,700
and the certificates that
are associated with it.

84
00:03:29,640 --> 00:03:31,650
I can get relationship information.

85
00:03:31,650 --> 00:03:33,000
Maybe this piece of malware

86
00:03:33,000 --> 00:03:35,910
comes bundled with
other pieces of malware.

87
00:03:35,910 --> 00:03:40,380
I can learn about its behavior
and its various mechanisms,

88
00:03:40,380 --> 00:03:43,050
and if anyone who's in
the VirusTotal community,

89
00:03:43,050 --> 00:03:44,670
which anyone can join,

90
00:03:44,670 --> 00:03:46,833
has a comment or more
information about it,

91
00:03:46,833 --> 00:03:48,630
well, I can read that as well.

92
00:03:48,630 --> 00:03:49,843
And if I learn more about it,

93
00:03:49,843 --> 00:03:52,500
I can submit it up through the community,

94
00:03:52,500 --> 00:03:55,263
so I can share what I've
learned with other people.

95
00:03:57,003 --> 00:03:59,850
Now, perhaps you don't have
malware on your system,

96
00:03:59,850 --> 00:04:01,680
but you're concerned that you have users

97
00:04:01,680 --> 00:04:03,690
potentially visiting a site

98
00:04:03,690 --> 00:04:06,240
that might be a malware distribution site.

99
00:04:06,240 --> 00:04:08,520
Well, another option is to input either

100
00:04:08,520 --> 00:04:11,820
an IP address or a URL.

101
00:04:11,820 --> 00:04:14,190
So I'm gonna add one right here.

102
00:04:14,190 --> 00:04:18,183
I'm gonna do Alegroup.info
and see what we can learn.

103
00:04:20,070 --> 00:04:21,840
It comes back that five engines

104
00:04:21,840 --> 00:04:23,944
detected this particular domain

105
00:04:23,944 --> 00:04:26,520
and they come back and say malicious,

106
00:04:26,520 --> 00:04:29,940
malware, suspicious, and phishing.

107
00:04:29,940 --> 00:04:32,610
So that confirms my concerns.

108
00:04:32,610 --> 00:04:36,450
Again, if I want more detail,
it tells me the categories.

109
00:04:36,450 --> 00:04:38,700
Sophos thinks it's a malware repository

110
00:04:38,700 --> 00:04:40,440
of spyware and malware.

111
00:04:40,440 --> 00:04:42,030
Forcepoint is telling me

112
00:04:42,030 --> 00:04:44,670
that it has potentially unwanted software.

113
00:04:44,670 --> 00:04:46,620
I can get some popularity ranks.

114
00:04:46,620 --> 00:04:49,800
Here, I can get information
about DNS records,

115
00:04:49,800 --> 00:04:51,843
and certificate information.

116
00:04:53,130 --> 00:04:55,410
I go relations, I can get information

117
00:04:55,410 --> 00:04:59,580
about the IP addresses that
this group has been used.

118
00:04:59,580 --> 00:05:02,220
I can see what the
various sub-domains are,

119
00:05:02,220 --> 00:05:05,070
communicating files, referring files,

120
00:05:05,070 --> 00:05:07,530
as well as Whois lookups.

121
00:05:07,530 --> 00:05:10,320
And once again, if the
community had any comments,

122
00:05:10,320 --> 00:05:13,203
I'd be able to get my community
comments there as well.

123
00:05:14,370 --> 00:05:16,410
So this is a really
interesting combination

124
00:05:16,410 --> 00:05:19,290
of open source community
and commercial vendors

125
00:05:19,290 --> 00:05:21,360
all participating together.

126
00:05:21,360 --> 00:05:23,040
I really, really recommend

127
00:05:23,040 --> 00:05:25,980
that you become a member of
the VirusTotal community.

128
00:05:25,980 --> 00:05:26,933
It's free to join.

129
00:05:26,933 --> 00:05:28,590
You can see the latest comments,

130
00:05:28,590 --> 00:05:30,240
just lots of really good information

131
00:05:30,240 --> 00:05:31,440
that comes out of here

132
00:05:31,440 --> 00:05:32,820
that you can learn from.

133
00:05:32,820 --> 00:05:34,984
And so importantly, if
you have anything to add,

134
00:05:34,984 --> 00:05:36,194
you can share it

135
00:05:36,194 --> 00:05:39,450
with your fellow
cybersecurity professionals,

136
00:05:39,450 --> 00:05:41,373
and that, my friend, is a Closer Look.