approach technology customers partners resources data sheets white papers webinars reports company about us pr & news research leadership careers solutions seculert javelin seculert shield how it works why seculert why seculert our approach technology customers partners resources data sheets white papers webinars reports company about us pr & news research leadership careers blogss contact us menu attackers are already in your network are you prepared to stop them before they succeed do you know what you don t know probably not ... 40 % of gateways fail we can show you . in 2 minutes or less seculert key benefits & features attack simulation performance gaps gateway shield real world threats exposed in 2 minutes ... fixed in 5 . seculert javelin is the first inside out attack simulation and remediation service that allows you to determine how well your secure web gateways swg next generation firewalls ngfw or proxy would do at preventing the latest real world malicious malware attacks from succeeding in communicating with their perpetrator s command and control servers . javelin replicates the destination based communication used by latest real world active trending attacks to exfiltrate data . the test takes less than 2 minutes to complete and uses no actual malware . javelin also provides a daily fix to fill the gaps in gateway performance identified by the attack simulation . to learn how to use the javelin s daily fix to update your gateway and avoid falling victim to current real world attacks click here . find out more is your gateway really protecting you your web gateway ngfw or proxy is designed to protect you from the effects of malware attacks that penetrate your network . but is it seculert labs research consistently reveals that as a category gateway solutions miss 40 % of malicious outbound communications and allow active attacks to communicate with their perpetrators . seculert labs also found that when a gateway fails to block attack communication it permits a lot of data to escape the network . the average number of successful outbound communications per incident or infected device is more than 100 . measured over time nearly all of the gateways observed exhibited uneven performance . while most performed well for weeks or months eventually all showed evidence of being defeated by the adversary . to learn how to use the javelin s daily fix to update your gateway and avoid falling victim to current real world attacks click here . find out more empower your gateway to contain evasive techniques in a perfect world it would be possible to identify new attacks in real time before they infect any devices on a large network . in the real world however attacks are stealthy and designed to defeat even the most the modern prevention solutions . the attackers have also adopted low and slow propagation strategies to make their attacks even harder to detect . the challenge this creates for security teams is how to best complement their prevention strategies with effective containment . designers of evasive techniques are intimately familiar with the capabilities and weaknesses of current prevention and containment solutions and are using this knowledge to develop a whole new generation of evasive techniques . these types of attacks can only be identified with sophisticated behavioral detection technologies based on superior anti malware science and machine learning . seculert shield is designed to perform exactly this job and provide soc teams with unique visibility into these techniques and provide the containment tools to stop them . find out more latest from the blog oct 11 2016 5 30 00 am nymaim deep technical dive adventures in evasive malware nymaim is mostly known worldwide as a downloader although it seems they evolved from former versions now having new ... visit the blog nymaim is mostly known worldwide as a downloader although it seems they evolved from former versions now having new functionalities to obtain data on the machine with no need to download a new payload . some of the exported functionalities allow harvesting passwords and browsers data from the machine hidden on the file system until communication occurs . payloads downloaded from the c & c are not saved locally on the machine but instead are loaded dynamically to memory with a unique internal calling convention . one of the signature features i noticed when i began analyzing the nymaim payload were the novel anti reverse engineering and obfuscation techniques . frustrating the analyzer many different code pieces for the same function requires piecing them together in order to fully understand the code . most of the code is heavily obfuscated using spaghetti code methods but we ll dive into that in a 1 bit . in addition to the already obfuscated code the dga domain generation algorithm use quite an interesting technique to make sure it won t be sink holed easily as well as further challenging analyzation . in this blog i will review the anti reverse engineering techniques the malware authors implemented in the code explain the unique dga they made and show different automation concepts to conquer the code and make the analyzer s life a lot easier . and so it begins ... in general when i dive into a new malware i begin with a set of goals or objectives i need to discover and understand such as the dga mechanism of a malware or analyzing the protocol and functionality . when i focus on the dga for instance while debugging i expect the malware to hit at some point a dns resolving function such as getaddrinfo gethostbyname or any similar api . unfortunately nymaim hit none of the expected dns resolving apis exported . confused for a moment i decided to try a breakpoint on the sendto function and indeed the breakpoint is hit . it is a crafted dns request with a messed up call stack and i can t conclude anything definitive i have to find the caller to the sendto function manually . following the rets and jmps i finally get to the function called the sendto function . but wait it looks so weird dramatic drumming fig. 1 the calling convention to the sendto function no way this is the sendto function so it continues obfuscation legit code protection let us examine the ida snippet above fig. 1 while keeping in mind what the sendto function looks like ws2 32 sendto socket s const char buf int len int flags const struct sockaddr to int tolen there are 6 arguments in total . after static analysis of the code the arguments passed on the stack don t make much sense in terms of what sendto is expecting value wise . also there are 9 push opcodes in total . something fishy is going on in there . let s examine the last call function call sub 1805525 which is the opcode i returned to manually from the sendto function . spoileralert this function is one of many spaghetti functions found in the code spoileralert fig. 2 how the called function looks like to fully comprehend what is going on we will first have to understand how the stack would look after calling this function in terms of ebp offsets first of all pushing eax arg 8 and then two more dwords arg 4 0xcf260f5f and arg 0 0x30d8fc16 . then calling the function call sub 1805525 which will put the appropriate ret address as the last value on the stack and that s all we need to know stack wise for now when calling this function . then inside the called function the function s prologue happens push ebpmov ebp esp this puts into the base register ebp the current stack address to relatively point to stack variables using ebp and not esp . let s see what this function does exactly as seen on the ida snippet above 0 1 overwrite arg 8 with the retaddress 2 3 sum the values of the two dwords pushed on the stack arg 0 arg 4 4 the result from the last operation will be added to the arg 8 which was already overwritten with the retaddress . basically it receives two numbers and a dummy stack value 3 arguments in total . resulting in a new return address with the value of returnaddress arg 0 arg 4 . xreferencing this whole mathematical function shows me it is being called from 36 more places . there are dozens more variants of this function and about 2600 different places in which all of the variants being called inside the code . back to analyzing the new address should be 0x0183bf0b 0x30d8fc16 0xcf260f5f cutting the 32 bit part will result in 0x0182ca80 fig. 3 api obfuscation for some api calls sendto commented great success the above snippet fig. 3 is another part of the obfuscation . the function that would be called next sub 180d32d is some api wrapper . actually there are no standard api calls anywhere in the code everything is calculated dynamically ... everything . it s terrible i know . diving into that api wrapper function is possible and actually required for the most part . however i won t do that in the scope of this blog post . so this spaghetti calling convention messes up the code and i will have to fix it if i want to do any effective static analysis of it . before i present the solution for this problem however let s examine the rest of the unresolved issues in the calling function to sendto . fig. 4 caller to the sendto function extra unresolved code the next thing we need to investigate is the repeated function sub 183ac7e fig. 5 push register obfuscation i will make it easy this is a huge switch case of putting a register value on the stack dependent of the given value . for example the following code our sendto scenario seg000 0183bed7 push 10hseg000 0183bed9 push 72h ; r seg000 0183bedb call sub 183ac7eseg000 0183bee0 push 6fh ; o seg000 0183bee2 call sub 183ac7eseg000 0183bee7 push 6ch ; l seg000 0183bee9 call sub 183ac7eseg000 0183beee push 73h ; s seg000 0183bef0 call sub 183ac7eseg000 0183bef5 push dword ptr ebp 184h push 10hpush esipush ebxpush eaxpush edipush dword ptr ebp 184h tom to tom to pot to pot to it s all the same to ... the two problems i aim to solve . one is fixing that spaghetti code calling convention and to fix the push reg function . these two functions rule most of the code so fixing these two should be a huge step forward in understanding the code and statically analyzing it . so how is it done easy magic or in its unofficial name ida python scripting an automation process to go over all of the code wherever one of these functions occur fix it and change it to a simpler and more readable code format while retaining the same functionality . so let s get practical shall we starting with the push reg function i need to change every call to that function which is made up of two opcodes 6a xx push byte e8 xx xx xx xx call dword push and call which are both in total 7 bytes in memory . if i could replace these 7 bytes with the appropriate values of the push register and do it over all of the code it will be a big step in de obfuscating the code . so now that i know exactly what i want to replace i wrote a script which does exactly that push register addr 0x0183ac7e push reg value 0x6c sizeof push byte 2 def fix reg push function address patched counter 0 unpatched counter 0 values to patch push reg value 0x50 push eax push reg value 1 0x51 push ecx push reg value 2 0x52 push edx