Guess who am I? PE or APK

 

Update: I happened to find this sample. However, it was corrupted.  So I made a demo file by myself. Notepad.exe was used as PE stub, and I embedded a MALICIOUS APK sample into it. So the magic number was also MZ. It ran better than the previous sample since it bypassed zipfile.py and you can see its internal apk information. 

If you need this sample, leave your email or drop me a line. You are welcomed to polish its PE structure to make it runnable. Don't forget to let me know if you make it. Good luck!
 
Does "zipfile.BadZipfile: Bad magic number for file header" sound familiar?

This error message is caused up by zipfile.py when a file fails in the ZipFile parsing.

Normally, the magic signature for a zip file is 1)"PK\003\004" , 2) "PK\005\006" (empty archive), or "PK\007\008" (spanned archieve).

Here is an android example which triggers the above message. Guess what is its magic number? - 4D 5A 90 90   Yes, you are right. It is "MZ", the PE magic number.

The author faked DOS header, PE header, section table, and even import table structure at the very beginning of this file so that quite a few AV engines and tools are bypassed.

 

 

 Here is the snapshot from VT:

 

7-zip unpacked partial contents including the classes.dex and Manifest files. The classes.dex is valid. There were some ADMOB SDK APIs called, and the android payload was hidden inside .text section.

This sample ran "su" command to get the root privilege. Afterwards, it visited the following websites:

mm.admob.com/static/android/i18n/20101109

/api.admob.com/v1/pubcode/android_sdk_emulator_notice

 ...

This is the only sample of trying to hide APK contents inside PE format I can find so far. I am expecting more in the near future.

Hey AndroGuard, I will crash you or your Python buddy!

AndroGuard is a popular tool to be used to analyze android APK files by security professionals.
Quite a few APK analysis tools have been built based on it. They usually call Python library to unzip APK files before reverse-engineering. No wonder some android malware were trying to applied some anti-debugging tricks to crash AndroGuard or Python, just like what PC malware had done on Ollydbg and IDAPro.

I came across a few android samples, which was able to crash (not crush) AndroGuard. I would like to share some information here.  However, I'm not quite sure if codes inside these samples are on purpose for anti-debugging or just some bugs of AndroGuard.

1.  uncommon padding values for "link_size" and "link_off" fields

2. unpack function failure from Python zipfile.py

Here is one example. The sample with MD5 value 22ff8b141bc187095ded6a431073028c protected itself from unzipping by AndroGuard. VT showed it as Android/Wooboo malware family.



Only 5 AV engines detected it as mailicous.



This sample caused an error by leveraging python's aligning on 4-byte boundaries
"unpack('<HH', extra[:4]) error: unpack requires a string argument of length 4".

This application reads the unique device ID, i.e the IMEI for GSM and the MEID or ESN for CDMA phones. It also called 'Landroid/content/Context;->getPackageName()Ljava/lang/String;' under the tag 'Wooboo SDK'.

Kudos to new patch of zipfile.py, it resolved this problem. You can download the latest version to make this patch.

def _decodeExtra(self):
        # Try to decode the extra field.
        extra = self.extra
        unpack = struct.unpack
        while len(extra) >= 4:
            tp, ln = unpack('<HH', extra[:4])

        ..... 

3. Manipulate unexpected value from search_methods()

 For example, a malicious sample can return unexpected values from search_methods("Landroid/media/MediaRecorder","setAudioSource", ".") so that
int(get_register_value(1, registers)) cannot get the correct information and will crash.
Some malware took advantage it to hide its "voice/audio recording" risk behavior.
It is the matter of how to write codes, not directly related with AndroGuard though.




Anyway, if you are doing some projects based on AndroGuard, make sure to download the latest version, which was updated in Dec 2012. The authors have added some fancy features,

Good job, AndroGuard guys!

Door-to-Door Worm Cleaner

Stop me if you’ve heard this one before.  I’m telling a new acquaintance that I work in IT, particularly the security sector. 

“Neat…so my computer has been running slow recently…” 

I want to make a good impression so I schedule some time and roll up my sleeves for however long it may take.  Given that this is someone else’s PC, I’m not going to risk plugging in any of my personal equipment to their network.  Instead I’ll be using only free tools that I tend to use when cleaning a PC I don’t own.  Wireshark, Bintext, Proexp are good enough starters and will help me diagnose anything I’ll need to without digging in too deep.

First thing you want to do when looking for something malicious on a friend’s PC is check if it is actively communicating.  I fired up Wireshark and started sniffing for common things which might be getting leaked out.  Sure enough…There is a worm actively looking for new computers on the network.  From a glance you can tell that it would like nothing better than to hook itself into explorer for the purposes of keylogging.   

Easy enough start.  A quick look-up on VirusTotal will tell you that the MD5 associated with that dropper is more than likely an E-mail worm of some kind.  I’m inclined to agree based on some e-mail looking strings found within the same communication.

Once you have a good idea about where this malicious file is hooked into, it’s a relatively simple to go to that process using ProExp and dump the malicious thread from memory.  Sure enough attached to IEEXPLORE.EXE is something called “Postcards.exe”.  One memory dump later and I think we may have found our culprit.

Prior to beginning this exercise, I had set the Windows Firewall to essentially block all communication from going out aside from SMB.  It’s a good thing I did that too because this bad guy was interested in much more than just passwords.  It is also looking to profile my computer for insertion into a botnet. A leading suspicion of this activity is due to the high volume of POST requests being made to .ru sites. 

Once it has spec-ed out my PC, it’s time to tell the mother ship that we have another zombie ready for the herd.  In the time I let it run, it attempted to send out information to the different sites using the same format:

hxxp://www.xxxxxxxxxxxx.ru/enabling/update.jsp?password=xxxxxx&version=1.0

Eventually, I just installed a few different Anti-spyware cleaning products on the PC to clean it up.  When dealing with a worm this feisty, it’s a good idea to separate the nodes and clean them up one at a time if this ever happens to your personal network.