Hexacorn

Hexacorn

Certain Windows… stay classy…

Posted on 2016-06-22 by adam

Update 2016-07-08

Added Thinstall applications

Old post

An ability to determine the compiler used to compile a binary is quite important. It determines the way we approach the reversing session and automatically tells us what tools to use. There are many static analysis tools available that help with the determination of the compiler/linker/protector used to build a specific binary.

Sometimes it may not be enough though.

In this post I will list a number of windows-related artifacts created by various programming frameworks that may help us to determine what is the payload compiled with. While there are many of such frameworks many of them rely on a very fixed number of more-or-less hidden windows, or window classes that stay persistent across many versions of the framework, or are created at some point in time.

This is by no means an exhaustive list – if you have anything to add, or find a mistake, I will appreciate the feedback.

Note: such list may be used for many purposes:

compiler/protector determination
data reduction (from strings, or f.ex. strings recognition in IDA, if it itself failed to do so well)
classification (whitelisting/blacklisting) of the sandboxes samples
installer discovery in sandbox analysis (may trigger a different handling routine f.ex. if Auto It is detected, or any installer, low-level logging may be disabled until the actual autoir / installer script starts execution, etc.)

Here’s the list I gathered:

Visual Basic

ThunderRT6Main
VBMsoStdCompMgr
VBFocusRT6 (this is from Visual Basic 6.0)
VBBubbleRT6 (this is from Visual Basic 6.0)
VBFocusRT5 (this is from Visual Basic 5.0)
VBBubbleRT5 (this is from Visual Basic 5.0)

Visual Basic .NET

VBNetStudio

MFC (Microsoft Foundation Classes/Application Framework Extensions)

Afx:<hexadecimal number>:<hexadecimal number> f.ex. ‘Afx:400000:0’ or ‘Afx:10000000:0’
Afx:StatusBar:<hexadecimal number> f.ex. ‘Afx:StatusBar:400000’
Afx:TabWnd:<hexadecimal number> f.ex. ‘Afx:TabWnd:400000’
Afx:ToolBar:<hexadecimal number> f.ex. ‘Afx:ToolBar:400000’

QT

Qt5QWindowIcon

Installer: Install Shield

GLBSInstall
InstallShield_Win

Installer: Inno Setup

class name: STATIC, window name: InnoSetupLdrWindow

Enigma Protector (not confirmed)

TEnigmaProtectorLoaderButton
TEnigmaProtectorLoaderEdit
TEnigmaProtectorLoaderFormMessage
TEnigmaProtectorLoaderFormRegistration
TEnigmaProtectorLoaderGroupBox

RunDll32 execution

RunDLL

OLE/DDE Windows

OleMainDdeClass

AutoIt

AutoIt v3
AutoIt v3 GUI
Au3Info
AutoIt
AutoIt – Splash

Standard Windows controls

ComboBoxEx32
commctrl_DragListMsg
msctls_hotkey32
msctls_progress32
msctls_statusbar32
msctls_trackbar32
msctls_updown32
NativeFontCtl
ReBarWindow32
RichEdit
RichEdit20a
SysAnimate32
SysDateTimePick32
SysHeader32
SysIPAddress32
SysListView32
SysMonthCal32
SysPager
SysTabControl32
SysTreeView32
ToolbarWindow32
tooltips_class32

Thinstall applications

ThStatusBarCtrlClass

Others

mdiclient (typical class name for MDI /Multiple Document Interface/)

And last, but not least, a ‘gallery’ of classes from a number of dynamically analyzed samples written in

Borland/Delphi/etc.

Enter Sandbox – part 11: Breaking the sandbox, literally :)

Posted on 2016-06-10 by adam

My homemade VMs run on VMWare. I use it for a number of years now and is my preference as it’s very fast (especially on SSD), configuration is very flexible, the management of snapshots is very user-friendly and in general – I am really happy with it.

I use VMWare to run some of automated malware analysis too and with nearly 1 million files processed there are occasions when it breaks.

I would be really curious to know what is the failure ratio for the commercial sandboxes, but I would imagine this must be happening quite a bit, given the volume of samples they process. I guess it’s probably one of the best stress tests for VMs – the code ran in a malware sandbox does a lot of funny stuff and is written by gazillions of clever programmers. There is a huge variety of code, data, errors, undocumented tricks, etc. – I bet some researchers already do it, but I would imagine this could be a good way to automate fuzzing of the VM software in order to find VM escapes.

In any case, since this post falls under ‘Enter sandbox’ series, it’s actually just a quickie dedicated to the dialog boxes that every once in a while kill my batch processing 🙂