Basic Static Analysis Techniques Flashcards
What is Static Analysis?
Static analysis describes the process of analyzing the code or structure of a program to
determine its function. The program is not run at that time.
What is Dynamic Analysis
The analyst actually runs the program
What do Antivirus tools rely on? Where is it stored?
File signatures, behaviors, and patterns. Antivirus databases, not the actual application
Malware writers can modify their code to prevent ___
Detection
What do hashes help with?
Identifying programs as legitimate
What is a string?
A sequence of characters.
What program can you use to search an executable for strings?
The Strings program in the Sysinternals Suite.
What format are strings stored in?
Either ASCII or Unicode
How do you terminate ASCII and Unicode strings
With a NULL terminator
What are obfuscated programs?
Programs whose execution the malware author has attempted to hide
What are packed programs?
A subset of obfuscated programs in which the malicious program is compresses and cannot be analyzed
What two types of programs strongly limit the ability to statically analyze malware
Obfuscated and packed programs
What is a packing file?
You open up an executable that causes another executable to run.
What type of files use Portable Executable (PE) format?
Windows executables, object code, and DLLs
What is the Portable Executable format?
It is a data structure that contains the information necessary for Windows to manage the wrapped executable code. Almost all files with executable code that is loaded by Windows is in the PE file format.
What are Imports?
Functions used by one program that are actually stored in a different program.
What are code libraries that contain functionality common to many programs an example of?
Imports
How are code libraries connected to the main executable?
Linking
What is the main executable?
The program being run
Why would programmer what to link imports?
So that they don’t need to re-implement certain functionality in multiple programs
What happens when a library is statically linked to an executable?
All code from that library is copied into the executable, which makes the executable grow in size
What is Static linking?
Linking in which the executable includes the files that the program needs
What is Dynamic linking?
~Linking in which the compiling and linking of code is put into a form that is loadable by programs at run time as well as link time.
What is the Imported Functions header?
A PE file header that includes information about the specific functions used by an executable.
What is the Exported functions header?
A PE header that contains information about functions that a file exports. Because DLLs are specifically implemented to provide functionality used by EXEs,
exported functions are most common in DLLs.
What is the Exported functions header?
A PE header that contains information about functions that a file exports. Because DLLs are specifically implemented to provide functionality used by EXEs,
exported functions are most common in DLLs.
What does the Kernel32.dll import tell you?
This software can open and manipulate processes and functions. It also means that the software can search through directories.
What does the User32.dll import tell you?
This software can open and manipulate GUI elements
What three functions allow you to open and manipulate processes?
OpenProcess, GetCurrentProcess, and GetProcessHeap
What three functions allow you to open and manipulate files?
ReadFile, CreateFile, and WriteFile
What two functions allow you to search directories?
FindFirstFile and FindNextFile
What three functions show that an executable has a GUI?
RegisterClassEx, SetWindowText, and ShowWindow
What function is commonly used in spyware and is the most popular way that keyloggers receive keyboard inputs?
SetWindowsHookEx
What function registers a hotkey so that whenever a hotkey combination is pressed the program is alerted?
RegisterHotKey
What does the GDI32.dll tell you about an executable?
The software is graphics related and has a GUI
What does the Advapi32.dll tell you about an executable?
The program uses the registry
What does it mean when the software is in the Software\Microsoft\Windows\CurrentVersion\Run portion of the registry.
The program runs at startup.
What is the LowLevelKeyboardProc function used for?
Used with the SetWindowsHookEx to specify which function will be called when a low-level keyboard event occurs
What is the LowLevelMouseProc function used for?
Used with the SetWindowsHookEx to specify which function will be called when a low-level mouse event occurs
