6 ms·
An onion of obfuscation
- bigmac 17y agoI'd be interested to know which steps of the packaging process were done automatically. Presumably these two could be automated in a straightforward fashion: Embedding a script in a command via cmd /C ... & ... & ... (twice) Generating a script and then running it (four times) The call to isDebuggerPresent in the final payload executable would be about zero inconvenience to a malware analyst. The sophistication of the packing makes me think there are probably other antidebug techniques present.
- mcantor 17y agoI'm a little confused. He says that it's a phishing attack and not a virus, but isn't the eventual payload an executable that does lots of dark win32 magic? I kept expecting him to describe how it launches your browser to a fake bank login site. Just curious... did I miss something?
- bigmac 17y agoYou're correct, the analysis is incomplete without analyzing the payload.
- angelbob 17y agoHe thinks it's for replacing a bit of your browser and doing phishing that way, based entirely on the symbols the executable imports. So it's a guess, but a semi-educated one.
- mcantor 17y agoI'll capitulate, but only if we get to subsequently call it a "phirus". (Though I suppose the lack of self-replication precludes calling it a virus.)
- netghost 17y agoI was hoping that an onion was the name for a group of obfuscations as per http://www.futilitycloset.com/2010/01/03/a-field-guide/ http://www.futilitycloset.com/2010/01/03/a-field-guide/