AnalyzeCON 2016 Slides

Transcript

9. •
10. • • •
11. 1512 Samples
12. • •
13. • • ◦
16. Count Useful __PAGEZERO ALL X NULL __TEXT 1832 √ Code and RO Data __OBJC 347* √ info often found in __TEXT sections __DATA 1825 √ Writable data __LINKEDIT 1830 X info __IMPORT 0 X Only IA32 Signature √ Code Signature
18. • ◦ •
19. __TEXT Count Unique Useful __text 1830 950 √ __text sections show code __cstring 1709 918 √ most __cstring sections are different __stub_helper 1602 696 √ most stub sections __unwind_info 1592 715 √ __const 1300 446 X __eh_frame 1119 577 X __stubs 915 416 √ __objc_classname 670 165 √ __objc_methname 653 260 √ __objc_methtype 645 182 __symbol_stub 633 215 __gcc_except_tab 601 350 __ustring 130 57 __symbol_stub1 105 75
20. __TEXT Count __text 1830 __cstring 1709 __stub_helper 1602 __unwind_info 1592 715 √ __const 1300 446 X __eh_frame 1119 577 X __stubs 915 416 √ __objc_classname 670 165 __objc_methname 653 260 __objc_methtype 645 182 __symbol_stub 633 215 __gcc_except_tab 601 350 __ustring 130 57 __symbol_stub1 105 75
29. Long Tail Distribution few adware families many other “families” - few samples
30. Approach Time Labeled Blind 1.5 day 316 files ML-Clustering 1 day 304 files Exact Clustering .5 day 628 files ??
31. • ◦ ◦ ◦ ◦
32. Approach Time Labeled Blind 1.5 day 316 files ML-Clustering 1 day 304 files Exact Clustering .5 day 628 files Mixed Approach ? ? and teamwork!
34. • 64a130000000 • 8b400c • 8b401c • 8b00 • 8b4820 • 81790c33003200 • 75f2 • 8b4008 • c3
35. • 64a130000000 • 8b400c • 8b401c • 8b00 • 8b4820 • 81790c33003200 • 75f2 • 8b4008 • c3
36. 64a130000000 ffff00000000 8b400c ffff00 8b401c ffff00 8b00 ffff 8b4820 ffff00 81790c00000000 ffff0000000000 75f2 ff00 8b4008 ffff00 c3 ff
37. • Operands ◦ Operand.type == Mnem == 0 == missing Operand ◦ up to idapi.UA_MAXOP Operands (6) ▪ workaround - just nulling out rest of instruction
39. • Library Functions - already in PAT (is this really a problem??) • Small Functions ◦ Jmp. ◦ retn 0 ◦ retn 1 ◦ Only hash functions that are greater than 3 instructions
40. • • •
47. • • ◦ • • • … • • •
48. • • •