Anatomy of File Analysis and Decomposition Engine
0 likes1,132 views
The document outlines a comprehensive approach for information collection and forensic analysis of files and binary objects, emphasizing metadata extraction like mobile app permissions and geolocation. It highlights the need for rapid processing at scale, addressing challenges such as file protection layers and varying complexities in analysis. Methods mentioned include preprocessing, validation, and the use of various identification engines for effective threat intelligence and security measures.
Anatomy of File Analysis and Decomposition Engine
- 4. • Collect as much information as possible from files/binary objects – Other contained files/objects – Metadata, e.g. mobile app permissions, geolocation, IP addresses, domains, etc. • Strip protection layers for additional analysis • Do it really, really fast • Do it at scale
- 5. • Forensics • Anti-Virus • Threat Intelligence • ...
- 7. • Files can be – Packed – Obfuscated – Encrypted – Broken • Large amounts of data to process • Speed
- 9. • Consolidating metadata and files/objects • Scheduling • Reporting • Communication
- 10. METADATA FILES ENGINE FILES
- 11. • Preprocessing – Identification – Initial analysis • Analysis – Unpacking – Validation • Post processing – Consolidating metadata
- 12. MODULES SCHEDULER VALIDATION IDENTIFICATION ANALYSIS UNPACKING ... REPORT, METADATA, FILES
- 13. • Speed • Security • We can emulate
- 15. • Various identification engines – Signature based – Heuristics – ... • Problems
- 16. • Signatures • Various complexity – Simple (e.g. PEiD) • Simple byte and wildcard matching, hash matching • 12 ?? 56 ?8 9? – Medium (e.g. TitanMist) • Small Regex like subset – High (e.g. TLang) • Almost full fledged programming language • Other
- 18. • Some parts depend on identification • Dedicated analysis modules • Internal/external modules
- 19. • Unpacking • Validation • Collecting metadata • Repairing broken files