Windows PE files Infections and Heuristic DetectionNicolas BRULEZ / Digital River

PACSEC '04

Introduction

Evolution of Computer Viruses

• Not Encrypted

• Encrypted

• Oligomorphic

• Polymorphic

• Metamorphic

PE File Format• MZ Header

• Le PE Header

• Le PE File Header

• Le PE optional Header

• Le Data Directory

• Les Sections Headers

Position Independant Code

• Virus needs to be executable at any memory addresses.

• Calcul of a Delta Offset

Windows PE Files Infections Techniques

Virus Position

• Last Section:

- New Section

BEFORE : AFTER :

Virus Position

• Last Section:

- New Section

Virus Position

• Last Section:

- Last Section Expansion

BEFORE: AFTER:

Virus Position

• Last Section:

- Last Section Expansion

Virus Position

• Header Infection

Virus Position

• CavityBEFORE: AFTER:

Entry Point Position

• In the Last Section

Entry Point Position

• In the First Section

Entry Point Position

• Before the First Section

e_lfanew Infection

• e_lfanew is a pointer to the PE Header Offset.

• You can find it at MZ+3Ch in the MZ HEADER.

• Infection by modification of e_lfanew is really straightforward.

• The virus is copied to the end of the file, but it doesn't need to have independant position code.

e_lfanew Infection

• Program is modified so its e_lfanew points to the Virus' PE header.

• Windows will therefore load the virus rather than the infected file.

• The virus will then make a temporary copy of the infected program and patch back the original pointer to PE header.

• The virus will finally run the temp file using CreateProcessA for example and will delete the temp file when this one ends.

Heuristic Detections on Windows PE Files

PE Structure Analysis

Heuristic Detections are mainly based on the PE File Structure

Analysis of Windows Executables.

• Entry Point• Sections Characteristiques• Sections names (with specific Characteristics)• Values not Updated in the PE HEADER.• Position of the PE HEADER in the file etc

PE Structure Analysis

• Entry Point in the Last Section

• Entry Point before the First Section

PE Structure Analysis

• Sections Characteristics :- Last Section « Executable »

- First Section « Writeable »

• Section names AND their Characteristics

PE Structure Analysis

• « SizeOfImage » incorrect in the PE Header

• PE Header near the end of the File

• « Size of Code » incorrect

Code Analysis

• Non Standard Instruction at the Entry Point

• Calcul of a Delta Offset

• Suspicious Code Redirection:

- JUMP FAR

- PUSH RET

etc..

Code Analysis

• Code Looking for PE Files

• Usage of PEB to gain system dlls Image Base

• Hardcoded value of systems important datas (PEB ...)

Code Analysis

• Suspicious Strings Inside Code Sections.

- "*.exe"

- Name of Win Functions: FindFirstFileA, MapViewOfFile etc..

- Registry Keys : Run / RunOnce etc.

Emulation

• JMP FAR

• PUSH / RET

• + Various ways to redirect code flow

• Decryptors Emulation ( Identification of loops)

Anti Heuristic Techniques

PE Structure

• Non Modification of Sections Characteristics

• More than one section added (fake reloc / imports)

• Part of code section overwriting to avoid suspicion.

• Packing of code section to place the virus is freed place

• EPO: Entry Point Obscuring

Structure PE

• FF15/FF25 (call IAT slots) Patches

• Stack Frame Patches

• Updated Checksums

• Existing Sections are renamed (when possible)

• « Size of Code » Fixed

Anti Emulation

• SEH - Structured Exception Handling.

• Co-Processor Instructions

• MMX / SSE Technology

• Undocumented Instructions

• Anti Virtual Machine Code

• Decryption Layers with Brute Forcing of Keys

• Threads

Anti Heuristic Code

• Delta Offset is calculated differently

• Usage of Obfuscation to hide suspect actions. (PE files checking etc)

• No more strings in the virus loader: CRC / HASH

Presentation of a Basic Heuristic Engine

Presentation of a Basic Engine

• Standard Binaries : notepad, regedit, calc, MS Pain, WordPad etc…

Presentation of a Basic Engine

Presentation of a Basic Engine

Presentation of a Basic Engine

Presentation of a Basic Engine

• Analysis of infected Binaries : Polymorphic, Crypted, Standard, EPO etc

Presentation of a Basic Engine

Presentation of a Basic Engine

Presentation of a Basic Engine

Presentation of a Basic Engine

Presentation of a Basic Engine

Presentation of a Basic Engine

Presentation of a Basic Engine

Presentation of a Basic Engine

Presentation of a Basic Engine

Notes:

Although, this is a basic engine, it detected heuristically every

viruses generated with a very recent Win32 Virus Generator.

(VCL32).

Presentation of a Basic Engine

• Analyse of Packed Files : PE protect, PEShield etc…

Presentation of a Basic Engine

Presentation of a Basic Engine

Presentation of a Basic Engine

Live Disassembly Demo

Live Demo

New Worm infected by a new Virus and PE packed.

Live Disassembly of a real virus.

This virus is very recent, and is not detected by most Anti Virus

vendors as im writing those slides.

Conclusion

Any Questions ?Nicolas BRULEZ / Digital River

PACSEC '04