{"id":1211,"date":"2012-08-19T12:08:40","date_gmt":"2012-08-19T12:08:40","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=1211"},"modified":"2012-08-20T12:20:12","modified_gmt":"2012-08-20T12:20:12","slug":"hexdive-0-4","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2012\/08\/19\/hexdive-0-4\/","title":{"rendered":"HexDive 0.4"},"content":{"rendered":"<p>It&#8217;s been a while since I updated HexDive, so I took some time today to fix a few things + add new keywords.<\/p>\n<p>So, what&#8217;s new?<\/p>\n<p>Mainly lots of new keyword sets. Some are just a tip of an iceberg and I will be extending these as I go through a malware collection in the future, but even at this stage these should certainly help in picking up some new interesting stuff, including but not limited to:<\/p>\n<ul>\n<li>new banking-related strings<\/li>\n<li>more information stealing strings (PStore, Firefox, FTP programs, Certificates, etc.)<\/li>\n<li>keystrokes (thx <a href=\"http:\/\/journeyintoir.blogspot.com\">Corey<\/a>)<\/li>\n<li>anti-sandbox tricks (partially based on an excellent summary post from <a href=\"http:\/\/joe4security.blogspot.hk\/2012\/08\/vm-and-sandbox-detections-become-more.html\">Joe Security LLC<\/a> and interesting new technique described by <a href=\"https:\/\/www.f-secure.com\/weblog\/archives\/00002408.html\">F-Secure<\/a>)<\/li>\n<li>swearwords<\/li>\n<li>lots of new registry keys related to settings, games, P2P, and lots of other applications<\/li>\n<li>some default passwords occasionally used by worms<\/li>\n<li>generic malware strings (lots of them, I still need to classify them, but at least they are already in the set)<\/li>\n<\/ul>\n<p>You can download current version of HexDive <a href=\"https:\/\/hexacorn.com\/download.php?f=hdive.exe\">here<\/a>. If your .exe download is blocked, you can try a <a href=\"https:\/\/hexacorn.com\/download.php?f=hdive.zip\">zip file<\/a>.<\/p>\n<p>p.s.<\/p>\n<p>I still don&#8217;t pay too much attention to a Linux version &#8211; this is lower priority than a different feature I am currently working on (stay tuned).<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Bonus update:<\/strong><\/p>\n<p>hdive ran over two gauss samples<\/p>\n<ul>\n<li>08D7DDB11E16B86544E0C3E677A60E10_100-dskapi.ocx<\/li>\n<li>5604A86CE596A239DD5B232AE32E02C6_smdk.ocx<\/li>\n<\/ul>\n<p>Various classes of interesting strings are highlighted:<\/p>\n<p><strong>08D7DDB11E16B86544E0C3E677A60E10_100-dskapi.ocx<\/strong><\/p>\n<p>CorExitProcess<br \/>\n<span style=\"color: #0000ff;\">mscoree.dll<\/span><br \/>\nnull<br \/>\nnull<br \/>\nsupport<br \/>\nopen<br \/>\nsupport<br \/>\nsupport<br \/>\n<span style=\"color: #0000ff;\">kernel32.dll<\/span><br \/>\nlocal<br \/>\nlocal<br \/>\nlocal<br \/>\ndefault<br \/>\nlocal<br \/>\n<span style=\"color: #993366;\">dddd, MMMM dd, yyyy<\/span><br \/>\nGetLastActivePopup<br \/>\nGetActiveWindow<br \/>\nMessageBoxA<br \/>\n<span style=\"color: #0000ff;\">USER32.DLL<\/span><br \/>\nSunMonTueWedThuFriSat<br \/>\n<span style=\"color: #0000ff;\">urlmon.dll<\/span><br \/>\n<span style=\"color: #ff0000;\">SeTakeOwnershipPrivilege<\/span><br \/>\n<span style=\"color: #339966;\">inflate<\/span><br \/>\n<span style=\"color: #339966;\"> deflate<\/span><br \/>\nabcd<br \/>\nABCD<br \/>\nabcd<br \/>\n<span style=\"color: #ff0000;\">SeRestorePrivilege<\/span><br \/>\n<span style=\"color: #ff0000;\"> SeTakeOwnershipPrivilege<\/span><br \/>\n<span style=\"color: #ff0000;\"> SeRestorePrivilege<\/span><br \/>\nLoadLibraryW<br \/>\n<span style=\"color: #0000ff;\">kernel32.dll<\/span><br \/>\nGetCommandLineW<br \/>\nSleep<br \/>\nkernel32.dll<br \/>\nFreeLibrary<br \/>\nkernel32.dll<br \/>\nVirtualFree<br \/>\nkernel32.dll<br \/>\nExitThread<br \/>\nkernel32.dll<br \/>\nDeleteFileA<br \/>\nkernel32.dll<br \/>\nMoveFileExA<br \/>\nkernel32.dll<br \/>\nntdll.dll<br \/>\n<span style=\"color: #ff0000;\">SeRestorePrivilege<\/span><br \/>\n<span style=\"color: #ff0000;\"> SeBackupPrivilege<\/span><br \/>\n<span style=\"color: #ff6600;\">RegCreateKeyExW<\/span><br \/>\n<span style=\"color: #ff6600;\"> RegSaveKeyW<\/span><br \/>\n<span style=\"color: #ff6600;\"> RegRestoreKeyW<\/span><br \/>\n<span style=\"color: #ff6600;\"> RegOpenKeyExW<\/span><br \/>\n<span style=\"color: #ff6600;\"> RegFlushKey<\/span><br \/>\n<span style=\"color: #ff6600;\"> RegCloseKey<\/span><br \/>\n<span style=\"color: #ff6600;\"> RegSetValueExW<\/span><br \/>\n<span style=\"color: #ff6600;\"> RegDeleteValueW<\/span><br \/>\n<span style=\"color: #ff6600;\"> RegQueryValueExW<\/span><br \/>\n<span style=\"color: #999999;\">ObtainUserAgentString<\/span><br \/>\n<span style=\"color: #999999;\"> HttpSendRequestW<\/span><br \/>\n<span style=\"color: #999999;\"> InternetQueryOptionW<\/span><br \/>\n<span style=\"color: #999999;\"> InternetSetOptionW<\/span><br \/>\n<span style=\"color: #999999;\"> InternetCloseHandle<\/span><br \/>\n<span style=\"color: #999999;\"> InternetQueryDataAvailable<\/span><br \/>\n<span style=\"color: #999999;\"> HttpAddRequestHeadersW<\/span><br \/>\n<span style=\"color: #999999;\"> InternetReadFile<\/span><br \/>\n<span style=\"color: #999999;\"> HttpQueryInfoW<\/span><br \/>\n<span style=\"color: #999999;\"> InternetOpenW<\/span><br \/>\n<span style=\"color: #999999;\"> InternetConnectW<\/span><br \/>\n<span style=\"color: #999999;\"> HttpOpenRequestW<\/span><br \/>\n<span style=\"color: #999999;\"> OpenProcessToken<\/span><br \/>\n<span style=\"color: #999999;\"> ImpersonateLoggedOnUser<\/span><br \/>\nAdjustTokenPrivileges<br \/>\nLookupPrivilegeValueW<br \/>\n<span style=\"color: #ff6600;\">RegDeleteKeyW<\/span><br \/>\nSetEntriesInAclW<br \/>\nFreeSid<br \/>\nMoveFileExW<br \/>\nCloseHandle<br \/>\nDeleteFileW<br \/>\nCreateMutexW<br \/>\nSleep<br \/>\nGetCurrentProcessId<br \/>\nVirtualAlloc<br \/>\nLoadLibraryW<br \/>\nCreateThread<br \/>\nGetModuleFileNameW<br \/>\nVirtualFree<br \/>\nGetCurrentProcess<br \/>\nGetModuleHandleA<br \/>\nOpenProcess<br \/>\nGetLastError<br \/>\nGetFileSize<br \/>\nReadFile<br \/>\nCreateFileW<br \/>\nGetPrivateProfileStringW<br \/>\nFreeLibrary<br \/>\nGetProcAddress<br \/>\nGetSystemTime<br \/>\nDuplicateHandle<br \/>\nMultiByteToWideChar<br \/>\nLoadResource<br \/>\nSizeofResource<br \/>\nLockResource<br \/>\nGetVersionExW<br \/>\nCreateToolhelp32Snapshot<br \/>\nGetFileAttributesW<br \/>\nGetModuleHandleW<br \/>\nSetFileTime<br \/>\nWriteFile<br \/>\n<span style=\"color: #33cccc;\">Process32FirstW<\/span><br \/>\n<span style=\"color: #33cccc;\"> ReadProcessMemory<\/span><br \/>\n<span style=\"color: #33cccc;\"> Process32NextW<\/span><br \/>\n<span style=\"color: #33cccc;\"> WriteProcessMemory<\/span><br \/>\n<span style=\"color: #33cccc;\"> VirtualAllocEx<\/span><br \/>\n<span style=\"color: #33cccc;\"> CreateRemoteThread<\/span><br \/>\n<span style=\"color: #33cccc;\">VirtualFreeEx<\/span><br \/>\nLocalFree<br \/>\nLocalAlloc<br \/>\nLoadLibraryA<br \/>\nTerminateProcess<br \/>\nSetUnhandledExceptionFilter<br \/>\nIsDebuggerPresent<br \/>\nGetCurrentThreadId<br \/>\nGetCommandLineA<br \/>\nHeapFree<br \/>\nGetVersionExA<br \/>\nHeapAlloc<br \/>\nExitProcess<br \/>\nGetFileType<br \/>\nGetStartupInfoA<br \/>\nDeleteCriticalSection<br \/>\nGetModuleFileNameA<br \/>\nFreeEnvironmentStringsA<br \/>\nGetEnvironmentStrings<br \/>\nFreeEnvironmentStringsW<br \/>\nWideCharToMultiByte<br \/>\nGetEnvironmentStringsW<br \/>\nHeapDestroy<br \/>\nHeapCreate<br \/>\nQueryPerformanceCounter<br \/>\nGetTickCount<br \/>\nGetSystemTimeAsFileTime<br \/>\nGetCPInfo<br \/>\nGetACP<br \/>\nLeaveCriticalSection<br \/>\nEnterCriticalSection<br \/>\nInitializeCriticalSection<br \/>\nSetFilePointer<br \/>\nGetStringTypeA<br \/>\nGetStringTypeW<br \/>\nGetLocaleInfoA<br \/>\nWriteConsoleA<br \/>\nWriteConsoleW<br \/>\nCreateFileA<br \/>\nFlushFileBuffers<br \/>\nGetSystemMetrics<\/p>\n<p><strong>5604A86CE596A239DD5B232AE32E02C6_smdk.ocx<\/strong><\/p>\n<p>CorExitProcess<br \/>\n<span style=\"color: #0000ff;\">mscoree.dll<\/span><br \/>\nnull<br \/>\nnull<br \/>\nsupport<br \/>\nopen<br \/>\nsupport<br \/>\nsupport<br \/>\nlocal<br \/>\nlocal<br \/>\nlocal<br \/>\ndefault<br \/>\nlocal<br \/>\n<span style=\"color: #0000ff;\">kernel32.dll<\/span><br \/>\ndddd, MMMM dd, yyyy<br \/>\nengland<br \/>\nchinese<br \/>\nchinese<br \/>\nchinese<br \/>\nchinese<br \/>\nGetProcessWindowStation<br \/>\nGetLastActivePopup<br \/>\nGetActiveWindow<br \/>\nMessageBoxA<br \/>\n<span style=\"color: #0000ff;\">USER32.DLL<\/span><br \/>\nSunMonTueWedThuFriSat<br \/>\n<span style=\"color: #339966;\">deflate<\/span><br \/>\n<span style=\"color: #339966;\">Jean-loup Gailly<\/span><br \/>\n<span style=\"color: #339966;\"> Mark Adler<\/span><br \/>\ntrue<br \/>\nRegOpenKeyW<br \/>\nRegCloseKey<br \/>\nRegQueryValueExW<br \/>\nRegOpenKeyExW<br \/>\nTerminateThread<br \/>\nCreateThread<br \/>\nProcess32NextW<br \/>\nCreateToolhelp32Snapshot<br \/>\nGetLastError<br \/>\nProcess32FirstW<br \/>\nDuplicateHandle<br \/>\nGetCurrentProcess<br \/>\nSetEvent<br \/>\nGetLogicalDriveStringsW<br \/>\nGetSystemTime<br \/>\nDeviceIoControl<br \/>\nCreateFileW<br \/>\nGetDriveTypeW<br \/>\nFindClose<br \/>\nFindFirstFileW<br \/>\nFindNextFileW<br \/>\nLocalAlloc<br \/>\nGetProcAddress<br \/>\nFreeLibrary<br \/>\nLoadLibraryA<br \/>\nTerminateProcess<br \/>\nSetUnhandledExceptionFilter<br \/>\nIsDebuggerPresent<br \/>\nGetCurrentThreadId<br \/>\nGetCommandLineA<br \/>\nHeapFree<br \/>\nGetVersionExA<br \/>\nHeapAlloc<br \/>\nGetModuleHandleA<br \/>\nSleep<br \/>\nExitProcess<br \/>\nGetFileType<br \/>\nGetStartupInfoA<br \/>\nDeleteCriticalSection<br \/>\nGetModuleFileNameA<br \/>\nFreeEnvironmentStringsA<br \/>\nGetEnvironmentStrings<br \/>\nFreeEnvironmentStringsW<br \/>\nWideCharToMultiByte<br \/>\nGetEnvironmentStringsW<br \/>\nHeapDestroy<br \/>\nHeapCreate<br \/>\nVirtualFree<br \/>\nQueryPerformanceCounter<br \/>\nGetTickCount<br \/>\nGetCurrentProcessId<br \/>\nGetSystemTimeAsFileTime<br \/>\nGetCPInfo<br \/>\nGetACP<br \/>\nLeaveCriticalSection<br \/>\nEnterCriticalSection<br \/>\nVirtualAlloc<br \/>\nWriteFile<br \/>\nInitializeCriticalSection<br \/>\nMultiByteToWideChar<br \/>\nGetStringTypeA<br \/>\nGetStringTypeW<br \/>\nGetLocaleInfoA<br \/>\nSetFilePointer<br \/>\nWriteConsoleA<br \/>\nWriteConsoleW<br \/>\nCreateFileA<br \/>\nFlushFileBuffers<br \/>\nGetFileSize<br \/>\nGetFileAttributesW<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It&#8217;s been a while since I updated HexDive, so I took some time today to fix a few things + add new keywords. So, what&#8217;s new? Mainly lots of new keyword sets. Some are just a tip of an iceberg &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2012\/08\/19\/hexdive-0-4\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[23,9,5],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1211"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=1211"}],"version-history":[{"count":11,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1211\/revisions"}],"predecessor-version":[{"id":1222,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1211\/revisions\/1222"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=1211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=1211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=1211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}