Juriaan Bremer und Marion Marschalek: Curing A 15 Year Old Disease
- 2. The Disease
- 3. Your Researchers Today Jurriaan Bremer Cuckoo Sandbox, Freelancer Marion Marschalek Cyphort Inc.
- 5. Visual Basic 6.0 Microsoft, 1998 Object-based / event-driven Rapid Application Development Replaced by VB .NET in 2002 End of support in 2008
- 7. 2000: Pikachu Worm • pikachupokemon.exe – „Pikachu is your friend!“ • Modifies AUTOEXEC.BAT to remove C:WINDOWS and C:WINDOBadWSsystem32 • Bad coding...
- 8. 2005: Kelvir Worm • Spreads through MSN Messenger by „lol! see it! u'll like it” message • Message points to omg.pif on home.earthlink.net • Spreads further & downloads and executes other malware
- 9. 2009: Changeup Worm • Polymorphic • Spreads through removable media and shared folders by 'LNK/PIF' Files Automatic File Execution Vulnerability • Downloads other malware
- 10. So.. why are we here?
- 11. VB6 IS NOT DEAD
- 12. VB6 101 1991: Visual Basic born 1998: Visual Basic 5.0/6.0 p-code and native code 2002: VB.NET and MSIL byte code
- 13. NATIVE CODE
- 14. PSEUDO CODE
- 15. P-Code Translation P-code mnemonics interpreted by msvbvm60.dll handler13: ExitProcHresult ... handler14: ExitProc ... handler15: ExitProcI2 ... ... FC C8 13 76 ...
- 17. Instruction Handler pushes integer onto the stack
- 18. Instruction Handler pushes integer onto the stack
- 19. Instruction Handler pushes integer onto the stack
- 20. Hello World!
- 21. Hello World!
- 22. Hello World!
- 23. Ou lá lá... HELLOU WORLD ^^
- 25. Existing VB Stuff •VB Decompiler •Tequila Debugger •IDA Scripts •Peter Ferrie, Masaki Suenaga
- 26. Most Advanced Sophisticated Private Cloud-based Big Data Intelligence Cyber Solution! (tm)
- 27. MASPCbBDICS FAIL COMPILATION Everything that didnt work...
- 28. DYNAMIC ANALYSIS
- 29. DECOMPILATION
- 31. DEBUGGING
- 32. DEBUGGING
- 33. DEBUGGING
- 35. V00D00 MAGIX
- 36. Most Advanced Sophisticated Private Cloud-based Big Data Intelligence Cyber Solution See which instructions are executed. Monitor interesting events as they happen. Inspect referenced strings, memory, and x86 code.
- 37. VB6 Instrumentation Patch the 6 jumptables! Generic Instrument everything Capture everything Create Statistics Specific Implementing specific instruction handlers “OpenFile” - filename
- 38. Patching A Function Handler Patch original address with our custom assembly stub 1. Store current register / stack state 2. Call custom instruction handler 3. Pass registers as parameters 4. Do STUFF 5. Restore original state Jump to original function handler. Life goes on.
- 39. Tailored Reporting For VB6 Custom printf() • BSTR unicode string with its size prepended • VARIANT generic wrapper around int, str, etc. Custom hexdump() to aid debugging
- 40. Slightly modified Cuckoo Sandbox Execute the sample with our custom DLL Cuckoofy It
- 41. VB6 ANALYSIS Obfuscation and garbage Anti-X features Three ways to call external functions The Somewhat Peculiar Results aka. Disease
- 42. Import Address Table (IAT) Only legitimate VB6 VM methods Dynamically Resolved Functions VB6 feature: DllFunctionCall Runtime decryption of API names WesumeThread, ZwWriteQirtualMemory, TetExitCodeThread Execute native x86
- 44. x86 to call CreateThread() other x86 code in a new thread
- 45. The Yet To Be Identified Infamous Anti-Cuckoo Feature (c)
- 46. Thank You! Project @ https://github.com/jbremer/vb6tracer