App Review Malware Analysis - Simple Habits to Stop Going Down the Rabbit Hole

[struppigel]

Content source

https://www.youtube.com/watch?v=deG_-5opR30

To summarize:

Don't dive immediately into code, create an overview first.
To do so:

• always extract strings (IDA strings tab is no replacement)
• always check file in a hex editor
• use visualization for large files to find interesting areas
• use automated analysis reports
• along the way make notes of interesting structures, strings, characteristics, behaviour

Strings extractors and hex editor cannot be fooled that easily. They work regardless of the file type.

If you go down a rabbit hole:

• stop, take a step back, take a break
• talk to colleagues, friends or a rubber duck about it
• go back to creating an overview again
• ask for help

 

[Freud2004]

Good job, I like a lot but a little too long the video.
Keep the good work

P.S. - You don't change the wallpaper in two years?

 

[struppigel]

Thank you.
Yes, since I am analysing a sample, there is no way to shorten it more. I wish I could talk faster in English, though. I have to think too much.
Regarding the wallpaper: At first I wanted to say that this is just a VM but then I realized I have my wallpaper on my actual laptop for at least 7 years now. So I guess that's just me.

 

[avman1995]

Also if you are reversing: its best to use tools like IDA-Scope when you are in doubt of whatever encryption a sample is using to protect its goodies. Another great hint in that regard would be to look for functions that are called plenty of times in IDA (xrefs) chances are that its something important !! Its okay to break your head on things sometimes. I have figures that's how i tend to remember things. If it gets too far ask for help but try it yourself first! Just start slow you can't pick up everything at once. Keep looking for stuff to analyze especially if the family has OSINIT reports on it they will help you enormously in understanding (try to emulate whatever they find and understand the technicalities). You have to keep going at it, only then the sword will get sharp and remain sharp !