Skip navigation.
Home

blogs

Releasing PDF X-RAY

| |

For the past few months I have been doing research on PDF analysis and how it could be better improved. While doing the research I found myself writing tools and scripts to help me get the job done and decided it was time to put something more useful together. PDF X-RAY is a static analysis tool that allows you to analyze PDF files through a web interface or API. The tool uses multiple open source tools and custom code to take a PDF and turn it into a sharable format. The goal with this tool is to centralize PDF analysis and begin sharing comments on files that are seen.

PDF X-RAY differs from all other tools because it doesn't focus on the single file. Instead it compares the file you upload against thousands of malicious PDF files in our repository. These checks look for similar data structures within the PDF you upload and ones that have been reviewed by analysts. Using this feature we can begin to see shared coded samples among malicious files or trends due to malicious author coding styles. The tool is still in beta, but I wanted to release it to the public to see what users thought. In my opinion the API is the most useful as you can begin to integrate rich PDF analysis into other tools and services with little or no cost.

PoC XMPP Bot C&C using Google Talk (video)

Earlier this year I put together an outline for a talk to cover how XMPP could be used as a botnet command and control. I just got around to playing around with the stuff and wanted to share some of the information I had and get opinions on what people thought about it all. I see XMPP as a more modern and flexible IRC when it comes to botnets. Features like federation, transports, p2p and client/server communication all make it seem to fit well in this area. Rather then waiting until it actually gets implemented, maybe we should think about what we could do to stop it or detect it now.

http://blog.9bplus.com/new-age-cc-xmpp-bots-preview

http://blog.9bplus.com/poc-xmpp-bot-cc-using-google-talk

Need help to simulate malware attack for SCADA system

Need help to simulate malware attack for SCADA system:

hi all,

I need some samples of malware which is used to simulate malware on our TestBed.
My project is about SCADA Security.
SCADA systems security is different from normal IT systems security.
Hence, please provide some Malware Samples for SCADA systems in Linux environment.

Thanks&Regards,
Shravansofts.

Reversing TDSS: The x64 Dollar Question

| |

In the two years since the Win32/Olmarik family of malware programs (also known as TDSS, TDL and Alureon) started to evolve, its authors have implemented a notably sophisticated mechanism for bypassing various protective measures and security mechanisms embedded into the operating system. Read more here Reverse Engineering Malware

The fourth version of the TDL rootkit family (TDL4) is the first reliable and widely spread bootkit to target x64 operating systems (Windows Vista and Windows 7). Since TDL4 started to spread actively in August 2010, several versions of the malware have been released. By comparison with its predecessors, TDL4 is not just characterized by modification of existing code, but to all intents and purposes can be regarded as new malware. Among the many changes that have been applied as it developed, the most radical were those made to its mechanisms for self-embedding into the system and surviving reboot. One of the most striking features of TDL4 is its ability to load its kernel-mode driver on systems with an enforced kernel-mode code signing policy (64-bit versions of Microsoft Windows Vista and Windows 7) and perform kernel-mode hooks with kernel-mode patch protection policy enabled. This makes TDL4 a powerful weapon in the hands of cybercriminals. In this article, we consider the PPI (Pay Per Install) distribution model used by both TDL3 and TDL4, and the initial installation.

Looking for Files Secure Rogue Sample

Files Secure v2.1

Please md5 or link

Thanks

YARA 1.5 released

A new version of YARA has been released. This version provides some new features, including:

* Process memory scanning
* Support for ELF files
* Faster regular expressions by using RE2 instead of PCRE

For more information visit:
http://code.google.com/p/yara-project

Generic Removal tool for Conficker..

Hi,
This is a great place to share, currently sharing generic Conficker/ Kido removal tool with you.

Conficker Removal Tool

Any suggestions or improvement
write to sushant@netlux.in

Best Regards
Sushant

A new bird in the malware research sky

Dear OffensiveComputing community,
I take the chance of this blog post to inform you of the release of Cuckoo 0.1.0-beta.
Cuckoo is a very simple automated malware analysis sandbox which makes use of Microsoft Detours, AutoIt3 and Python for analyzing malwares in a VirtualBox based environment.
At this point it is able to analyze Windows binaries and PDF files, but can be easily extended.
Here are some basic features:

  • Retrieve files from remote URLs and analyze them.
  • Trace relevant API calls for behavioral analysis.

ShmooCon 2011: Visual Malware Reversing

This past weekend I had the pleasure of presenting at ShmooCon 2011. This conference continues to be one of my favorites. Shmoocon is a small conference that is trying very hard to stay that way. This year I talked about my improvements to VERA over the past 6 months. Much of the talk was centered around live demos, which unfortunately did not make it to the slides. The new tracing module and updated versions of the VERA code will be posted here soon.

Video of the Talk
PDF of the Powerpoint Slides
Download the new VERA code here

Abstract:

Reverse engineering is a complicated process that has a lot of room for improvement. This talk will showcase some improvements to our visualization framework, VERA. New features that decrease the overall time to reverse a program will be shown. New items are a debugger based interface which allows for faster analysis without the need for a hypervisor, integrated trace processing tools, IDA Pro integration, and an API to interface with the display. During the talk I will reverse engineer malware samples, and show how to integrate it into your reversing process.

Danny

Paper: Hunting rootkits with Windbg

Here are the slides to my talk "Hunting rootkits with Windbg" at the Ruhr University of Bochum yesterday. I'll introduce several ways to find well known rootkits like Rustock or TDL Versions 3+4 with Windbg and scripts. Enjoy!

http://www.reconstructer.org/papers/Hunting rootkits with Windbg.pdf

The Windbg script shown in the slides to grab Kernelcallbacks can be found here:

http://www.reconstructer.org/code/WindbgScript-KernelCBFindx86.rar

Syndicate content