You are browsing the archive for Silly.

A few things about EICAR that you may be not aware of…

April 10, 2016 in Incident Response, Malware Analysis, Others, Preaching, Puzzles, Security Control, Silly

When my wife studied her MA in graphic design and branding she got a lot of interesting home work. One of them was… ‘The square’. She spent a lot of time brainstorming and eventually produced a large collection of ideas that got her a good mark. Now, the simple purpose of that exercise was to play around with the idea of… ideas. As simple as it sounds, the moment you start exploring one ‘simple’ subject you will soon find yourself deep in a forest.

As I am adding support for many Quarantine files now (to DeXRAY) I suddenly found myself in a world of Antivirus analysis. One thing that somehow connects all of AV products is not their functionality, or Utopian vision of full protection, but… the EICAR file.

I decided to explore the topic of this file a bit – same as my wife was exploring the square. Yup, here’s a boring story SLASH a bunch of ideas associated with EICAR SLASH and other topics like this …

First of all – in case you don’t know – EICAR is a small file that is used as a test for security products (in the past it was mainly antivirus, but nowadays it should apply to any security solution that looks at files/content of any sort really). Once you deploy/install the solution/product, you can drop the EICAR file all over the place and see if solution picks it up. Notably, some AV vendors apparently do not understand what EICAR’s purpose is and decided not to detect it. I won’t be pointing fingers, but upload EICAR file to VirusTotal and you will know who I am talking about.

Naming conventions in AV is a subject to many debates over many years. EICAR looks like a no-brainer though as it’s an artificial file created with a single purpose and its origin and name are well-documented. It doesn’t help though… it would seem that vendors can’t agree on one, single name. Here is a histogram of names used by AV:

EICAR_test_file                  11
EICAR-Test-File                   7
EICAR-Test-File (not a virus)     4
Eicar test file                   3
EICAR (v)                         2
Eicar-Test-Signature              2
EICAR.Test.File                   2
EICAR.TestFile                    2
EICAR Test File (NOT a Virus!)    1
EICAR.TEST.NOT-A-VIRUS            1
EICAR-Test-File (not a virus) (B) 1
EICAR Test String                 1
DOS.EiracA.Trojan                 1
Marker.Dos.EICAR.dymlmx           1
EICAR.Test.File-NoVirus           1
NORMAL:EICAR-Test-File!84776 [F]  1
EICAR-Test-File!c                 1
EICAR Test-NOT virus!!!           1
Win32.Test.Eicar.a                1
Misc.Eicar-Test-File              1
EICAR_Test                        1
NotAThreat.EICAR[TestFile]        1
qex.eicar.gen.gen                 1
TestFile/Win32.EICAR              1
Virus:DOS/EICAR_Test_File         1
EICAR-AV-Test                     1
EICAR-AV-TEST-FILE                1
EICAR-test[h]                     1

And the bonus: one of these even has a typo. Can you spot it?

EICAR is a very strange phenomenon.

It is an organization. It is a file. It has a dedicated web site. It haz a dedicated con. Its original name is inclusive of Europe, and exclusive of other continents (EICAR stands for ‘European Institute for Computer Antivirus Research’; deprecated name, but always…).

Anagrams of EICAR are ERICA, CERIA and AREIC. They serve no purpose in this article.

Properties:

File size: 68 bytes
MD5: 44D88612FEA8A8F36DE82E1278ABB02F
SHA1: 3395856CE81F2B7382DEE72602F798B642F14140
SHA256: 275A021BBFB6489E54D471899F7DB9D1663FC695EC2FE2A2C4538AABF651FD0F
CTPH: 3:a+JraNvsgzsVqSwHq9:tJuOgzsko
Entropy: 4.872327687

Eicar is a DOS file and can be executed… but only under old versions of Windows.

eicar

The source code is using the same tricks as shellcodes:

  • code is obfuscated

eicar2

  • it is a self-modifying code (patching itself)

eicar3

eicar4

Does your sandbox solution accept EICAR? Test it.

There exist tools that help you to generate EICAR file and its cousins (file formats embedding EICAR).

There exist a close friend of EICAR called AMTSO (Anti-Malware Testing Standards Organization) that focuses on testing antimalware methods. It produces some more test files to support the original idea introduced by EICAR f.ex. Potentially Unwanted Application equivalent of EICAR:

puaeicar

with the histogram of detection names as follows (VT detection rate: 43/56 – mind you that the file was compiled on 2013-04-04 21:26:07 (Thursday)):

Application.Hacktool.Amtso.A                             5
Riskware ( 0040eff71 )                                   2
AMTSO-Test                                               2
PUA_Test_File                                            2
RiskTool.EICAR-Test-File.r5 (Not a Virus)                1
RiskWare[RiskTool:not-a-virus]/Win32.EICAR-Test-File     1
RiskTool.Win32.AMTSOTestFile (not malicious)             1
Amtso.Test.Pua.A                                         1
W32/PUAtest.B                                            1
AMTSO_PUA_TEST                                           1
RiskTool.Win32!O                                         1
Application.Win32.AmtsoTest.a                            1
Riskware.AMTSO-Test-PUA                                  1
Application/AMTSOPUPTestfile                             1
Trojan.Staser.gen                                        1
Application:W32/AMTSOPUATestfile                         1
W32/TestFile.LCMA-1046                                   1
Backdoor.CPEX.Win32.29390                                1
Risktool.W32.Eicar.Test!c                                1
Hacktool.Win32.EICAR-Test-File.aa                        1
RiskTool.Win32.AMTSOTestFile                             1
not-a-virus:RiskTool.Win32.EICAR-Test-File               1
AMTSO-PUA-Test                                           1
PE:Malware.Generic/QRS!1.9E2D [F]                        1
Riskware.Win32.EICARTestFile.dmxhvk                      1
PUA.AMTSOTest                                            1
SpyCar                                                   1
PUA/AMTSO-Test                                           1
Trojan/W32.Agent.33280.TI                                1
Win32/PUAtest.B potentially unwanted                     1
W32/TestFile                                             1
Win32:AmtsoTest-A [PUP]                                  1
AMTSO-PUA-Test (PUA)                                     1
RiskTool.EICAR-Test-File.a                               1
AMTSO Test File PUA (Not a Virus!)                       1
PUP/Win32.AMTSO_Test                                     1

…and the cloudish EICAR file as well. Here’s the histogram of names given to the cloudish EICAR file (only 23/56 vendors detect it on VT; compilation date:  2010-07-08 23:02:46 (Thursday), ouch!):

AMTSO_TEST_CLOUDCAR                    2
Cldcar-Test!3FB121FBBCCB               2
Trojan.Win32.Generic!BT                2
Trojan.Agent/Gen-CloudTest             1
Virus:DOS/EICAR_Test_File              1
Trojan.Generic                         1
Application.Win32.CloudTest.s          1
Win.Trojan.11584714-1                  1
Amtso.Test.Cloudcar.A                  1
Trojan.Brodcom.Win32.366               1
Trojan.Win32.DangerousObject.dlgbhn    1
AMTSO-CLOUD-Test                       1
Trojan.Win32.Z.Agent.7178[h]           1
CLOUDCAR_Test                          1
UDS:DangerousObject.Multi.Generic      1
DangerousObject.Multi.Generic!c        1
W32/GenBl.3FB121FB!Olympus             1
Mal/Generic-S                          1
AMTSO Test File (NOT a Virus!)         1
Trj/CI.A                               1

There also exist a close friend fo EICAR called GTUBE (Generic Test for Unsolicited Bulk Email) for testing anti-spam solutions. It is also 68 bytes long.

Last, but not least – there exists a shorter version of EICAR and it is 12 bytes SHORTER than the original!

The Base64-encoded EICAR looks like this:

WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JDIDYOUSPOTTHISEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNU
LUZJTEUhJEgrSCo=

You may come across it as it is being used in various tests and… it is a method used by Esafe to save Quarantine files. And… maybe you can’t read this post in case your security product is over protective and detected the BASE64-encoded EICAR string. Well, if it does… it shouldn’t, as I included ‘DIDYOUSPOTTHIS’ in the BASE64 encoding above. Well, did you spot that DIDYOUSPOTTHIS?

EICAR is a tool. I use it to test Quarantine files’ encryption. When I find no encryption, or trivial encryption/encoding – I love EICAR. When I have to dig into some actual code to find out how they transform the original EICAR bytes into sth terrible I absolutely hate this little piece of hybrid data/code ;).

Beyond good ol’ Run key, Part 34

February 16, 2016 in Autostart (Persistence), Compromise Detection, Forensic Analysis, Silly

I mentioned various laptop/touchpad software in my older posts in this series (Synaptics, Alps). I recently came across yet another production from the Alps which is installed on some of the Toshiba laptops. Browsing through the available options of the Alps Pointing-device Driver software I discovered two potential exotic persistence locations which probably will never be abused, but are still worth mentioning – for completeness, and because the software is somehow vintage and hilarious at the same time.

First, the vintage part. Alps offers a tray-icon based Easy Launcher. I think the software was designed really long time ago, way before Windows XP and 7 existed (let alone newer versions) and at that time it was probably a nice extension to have. In today’s Window’s user interface world there are so many better ways of achieving the same goal that it is really funny to see an archaic-looking Easy Launcher at work (let alone being installed on laptop from 2015; touche Toshiba).

Let’s see:

  • To launch the Easy launcher, we need to click the Touchpad icon in the tray icon (notification) area
  • We will see the following user interface:

easylauncher1

  • We then need to click the Easy Launcher which shows us… an old-school menu

easylauncher2

  • Selecting Specified Files will show the available options, including one item which I defined for demonstration purposes – a menu element that launches Calculator

easylauncher3

All the data that Easy Launcher shows is taken from the following registry location:

  • HKEY_CURRENT_USER\Software\Alps\Apoint\EasyLauncher

as seen below:

easylauncher4

where:

  • C01 = A command being executed by the menu item #1
  • I01 – A path to a file that the icon shown by Easy launcher will be taken from
  • T01 – A title, as seen in the Easy Launcher menu

It is pretty obvious that we can modify the C01 entry (and other, relevant Cxx entries) in the Registry to point to some man-in-the-middle malicious executable that will execute calculator (in our case) when launched, or we can simply hijack the whole entry.

For example: changing C01 to point to C:\Windows\System32\notepad.exe will launch Notepad anytime Calc is selected from the menu. Interestingly, since it is the I01 entry that holds an information about the source of the icon presented on UI, there will be no visible clue that the entry now points to Notepad.

Such malicious hijacking effort certainly won’t fool an experienced power-user of the Easy Launcher who will be able to swiftly discover the modifications by exploring the modified settings as shown below:

easylauncher0

The second best exotic persistence mechanism I am going to describe is like the second best exotic Marigold Hotel – it is certainly promising, but to deliver, will require a lot of effort; and this time not from the attacker, but from the attackee. This is the hilarious bit.

There is a mysterious gesture function that Alps touchpad offers called 3-Fingers Press which relies on a simultaneous caress delivered to the touchpad with a power of 3, precisely synchronized fingers. The gesture is so subtle and refined that any threat actor considering this maneuver as a way to persist on the targeted system is definitely the Sun Tzu of all APT actors, both the real ones and those imagined. Despite many efforts, boot camps and 1000 hours on the touchpad simulator, I yet have to accomplish the mission of mastering this unique fingering stance – and for that reason (and one more reason mentioned below) I name this APT persistence mechanism the self-touch of death.

On a technical note, the secret setting enabling the magic gesture is hidden in Advanced options:

selftouchofdeath1

There, one can enter the Settings dialog box and – lo and behold – add multiple executables in one go:

selftouchofdeath2

In an attempt to understand the logic behind the design of this feature, I came up with a hypothesis that I cannot unfortunately share on a public forum. The ability to run multiple executables with a single stroke is certainly a stroke of genius. And as such, a perfect reason to call it the self-touch of death.

Last, but not least, the settings that manage this feature are stored in the following location:

  • HKEY_CURRENT_USER\Software\Alps\Apoint\Mouse

selftouchofdeath3

Due to a unique nature of this persistence mechanism and APT actors potentially hidden behind it I do not recommend developing regripper plug-in for it.