Introduction to Malware & Malware Obfuscation 2/2

Sample folder {
// naming things is up to you.
src_code -> main.c, external_lib.c
header_files -> external_lib_header.h, sqlite3.h
bin      -> sample.exe
libraries // Not needed
imports // Not needed
Makefileb
}

• download the sqlite3 [amalgamation version]
• extract zip
• Copy sqlite3.h into Sample/header_files/sqlite3.c then Sample/header_files/
• cd into Sample/src_code then use your preferd coding editor to open sampel.c with.
• manually change evrey instance of the func s() with what the safe version of strcat(This a small c excerise on it's own because im tight on time to do it)
• save and exit
• inside Sample run gcc(mingw version) -shared -o bin/libsample.dll -Iheader_files/ src_code/external_lib.c header_files/sqlite3.h -Wl,--out-implib,imports/libsample.dll.a
• gcc -o bin/sample.exe -Iheader_files src_code/main.c -Limports -lsample

• String Matching: VirusTotal's heuristic scans, for example, look for exact matches of known malicious strings. By simply renaming functions, the code’s functionality remains identical,
• but the signature is completely different.

• If VirusTotal processes imports at runtime only, they would refer to the IMAGE_THUNK_DATA returned by the IAT (Import Address Table), which will have an absolute pointer to the function code inside the loaded imported DLL. The DLL’s base address plus the IAT thunk will give you the function name.
• If VirusTotal processes imports statically (on disk), then the process will be a loop of pointer referencing: IMAGE_IMPORT_DESCRIPTOR[N].OriginalFirstThunk -> THUNK_DATA -> IMAGE_IMPORT_BY_NAME char pointer, Very simple.

A.Parsing the Compressed PE Headers: The compressed data isn't just the code. UPX for example stores a modified (often stripped) version of the original PE headers and section headers that contain only the bare minimum.

struct MinPEInfo {
DWORD  EntryPointRVA;
DWORD  ImageBase;
DWORD  SizeOfImage;
DWORD  SectionAlignment;
DWORD  FileAlignment;
WORD   NumberOfSections;
WORD   Subsystem;
DWORD  SizeOfHeaders;
};

struct MinSection {
DWORD  VirtualAddress;    // RVA where section loads
DWORD  SizeOfRawData;     // Size in file
DWORD  VirtualSize;       // Size in memory
DWORD  Characteristics;   // Permissions (rx/rw/etc)
DWORD  PointerToRawData;
// Don't need to save the section names, names do not matter neither for us or the ldr
};

[list]
struct MinImports {
DWORD  IAT_RVA;           // Where IAT should be
DWORD  NumDLLs;           // How many DLLs
// Followed by: <DLL_name><func1><func2>...<0><next_DLL>...
};

B. Allocating Memory: The stub uses VirtualAlloc to allocate memory at the preferred base address of the original PE file, not the stub's own base address. If that allocation fails (because the memory is already occupied), it handles relocation by adjusting memory addresses accordingly.

C. Mapping Sections: It decompresses and copies each section (e.g., .text, .data, .idata, .rdata, .reloc, .pdata, etc.) from the compressed blob into the correct memory addresses within the newly allocated memory block, example

for (int i = 0; i < numSections; i++) {
BYTE* sectionDestination = imageBase + sections.VirtualAddress;

// Copy section data from your compressed or decrypted buffer
memcpy(sectionDestination, compressedData + sections[i].PointerToRawData,sections[i].SizeOfRawData);
// make sure section aligment isn't  messed up
DWORD alignedVirtualSize = ALIGN_UP(sections[i].VirtualSize, SectionAlignment);
DWORD paddingSize = alignedVirtualSize - sections[i].SizeOfRawData;

if (paddingSize > 0) {
memset(sectionDestination + sections[i].SizeOfRawData, 0, paddingSize);
}
}