Skip to content

Commit 082a4db

Browse files
author
Amanda Rousseau
committed
adding ReportForm
1 parent e35cff7 commit 082a4db

File tree

5 files changed

+1028
-6
lines changed

5 files changed

+1028
-6
lines changed

‎ReportForm.html

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta charset="utf-8">
5+
<meta http-equiv="X-UA-Compatible" content="chrome=1">
6+
7+
<script type="text/javascript" src="view.js"></script>
8+
9+
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js"></script>
10+
<script language="JavaScript">
11+
12+
$("#btnPrint").live("click", function () {
13+
var divContents = $("#display").html();
14+
var printWindow = window.open('', '', 'height=400,width=800');
15+
printWindow.document.write('<html><head><title>Malware Analysis Report</title>');
16+
printWindow.document.write('</head><body >');
17+
printWindow.document.write(divContents);
18+
printWindow.document.write('</body></html>');
19+
printWindow.document.close();
20+
printWindow.print();
21+
22+
});
23+
24+
function showInput() {
25+
document.getElementById('display').innerHTML =
26+
27+
"<div id=\"malwarereport\" class=\"malwarereport\">" +
28+
"<br>Filename: " + document.getElementById("element_1").value + "</br>" +
29+
"<br>Sha256: " + document.getElementById("element_2").value + "</br>" +
30+
"<br><h3>Summary</h3></br><br>" + document.getElementById("element_3").value + "</br>" +
31+
"<br><h3>General Characteristics</h3></br><br>" + document.getElementById("element_4").value + "</br>" +
32+
"<br><h3>AntiVirus Detection Results</h3></br><br>" + document.getElementById("element_5").value + "</br>" +
33+
"<br><h3>File System IOC</h3></br><br>" + document.getElementById("element_6").value + "</br>" +
34+
"<br><h3>Network IOC</h3></br><br>" + document.getElementById("element_7").value + "</br>" +
35+
"<br><h3>Registry IOC</h3></br><br>" + document.getElementById("element_8").value + "</br>" +
36+
"<br><h3>Behavior & Control Flow</h3></br><br>" + document.getElementById("element_9").value + "</br>" +
37+
"<br><h3>Appendix</h3></br><br>" + document.getElementById("element_10").value + "</br>" +
38+
"<br><h3>End of Report</h3></br>";
39+
40+
"</div>"
41+
}
42+
</script>
43+
44+
45+
<link rel="stylesheet" type="text/css" href="view.css" media="all">
46+
<link rel="stylesheet" href="https://securedorg.github.io//assets/css/style.css?v=5e63b4f7f8d5ec379a428172f4517e17cf6f662e">
47+
48+
</head>
49+
<body>
50+
<div >
51+
52+
<form id="form_21154" class="appnitro" method="post" action="">
53+
<div class="form_description">
54+
<h2>Malware Analysis Report</h2>
55+
<p>by @malwareunicorn</p>
56+
<p>Insert information in this report as you analyze malware. It will generate a text output.</p>
57+
</div>
58+
<ul >
59+
60+
<li id="li_1" >
61+
<label class="description" for="element_1">Filename </label>
62+
<div>
63+
<input id="element_1" name="element_1" class="element text medium" type="text" style="width: 500px;" maxlength="255" value=""/>
64+
</div><p class="guidelines" id="guide_1"><small>Original Filename</small></p>
65+
</li> <li id="li_2" >
66+
<label class="description" for="element_2">Sha256 Hash</label>
67+
<div>
68+
<input id="element_2" name="element_2" class="element text large" type="text" maxlength="255" value=""/>
69+
</div><p class="guidelines" id="guide_2"><small>Unique Identity</small></p>
70+
</li> <li id="li_3" >
71+
<label class="description" for="element_3">Summary</label>
72+
<div>
73+
<textarea id="element_3" name="element_3" class="element textarea medium"></textarea>
74+
</div>
75+
</li> <li id="li_4" >
76+
<label class="description" for="element_4">General Characteristics</label>
77+
<div>
78+
<textarea id="element_4" name="element_4" class="element textarea medium"></textarea>
79+
</div><p class="guidelines" id="guide_4"><small>File Format,
80+
Header Analysis,
81+
Basic PE information,
82+
Delivery Context</small></p>
83+
</li> <li id="li_5" >
84+
<label class="description" for="element_5">AntiVirus Detection Results</label>
85+
<div>
86+
<textarea id="element_5" name="element_5" class="element textarea medium"></textarea>
87+
</div><p class="guidelines" id="guide_5"><small>AV Results
88+
Yara Analysis Results
89+
Virustotal Results</small></p>
90+
</li> <li id="li_6" >
91+
<label class="description" for="element_6">File System IOC</label>
92+
<div>
93+
<textarea id="element_6" name="element_6" class="element textarea medium"></textarea>
94+
</div><p class="guidelines" id="guide_6"><small>Any changes on the file system made by the malware
95+
Created/Deleted/Modified Files</small></p>
96+
</li> <li id="li_7" >
97+
<label class="description" for="element_7">Network IOC</label>
98+
<div>
99+
<textarea id="element_7" name="element_7" class="element textarea medium"></textarea>
100+
</div><p class="guidelines" id="guide_7"><small>Network Related IOC
101+
GET/POST Requests
102+
Domains
103+
IP address</small></p>
104+
</li> <li id="li_8" >
105+
<label class="description" for="element_8">Registry IOC</label>
106+
<div>
107+
<textarea id="element_8" name="element_8" class="element textarea medium"></textarea>
108+
</div><p class="guidelines" id="guide_8"><small>Any changes in the Registry made by the malware</small></p>
109+
</li> <li id="li_9" >
110+
<label class="description" for="element_9">Behavior & Control Flow</label>
111+
<div>
112+
<textarea id="element_9" name="element_9" class="element textarea medium"></textarea>
113+
</div><p class="guidelines" id="guide_9"><small>List the order of events, processes, and capabilities.</small></p>
114+
</li> <li id="li_10" >
115+
<label class="description" for="element_10">Appendix</label>
116+
<div>
117+
<textarea id="element_10" name="element_10" class="element textarea medium"></textarea>
118+
</div><p class="guidelines" id="guide_10"><small>Add any strings, code, interest notes</small></p>
119+
120+
</ul>
121+
</form>
122+
123+
124+
</div>
125+
126+
<p><input type="submit" onclick="showInput();"></p>
127+
<p><label>Your Report: </label></p>
128+
<hr>
129+
<p><span id='display'></span></p>
130+
<p><input type="button" value="Print PDF Report" id="btnPrint" /></p>
131+
132+
</script>
133+
134+
</body>
135+
136+
</html>

‎retools.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ title: RE Tools
7575
## Information Gathering
7676

7777
* [CFF Explorer](http://www.ntcore.com/exsuite.php) - PE header parser (Used in this worksop)
78+
* [BinText](https://www.mcafee.com/hk/downloads/free-tools/bintext.aspx) - Extract string from a binary
7879
* [Sysinternals Suite](https://technet.microsoft.com/en-us/sysinternals/bb842062.aspx) (Used in this worksop)
7980
* procmon
8081
* procexplorer

‎triage.md

Lines changed: 61 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,66 @@ title: Triage Analysis
77

88
# Section 4: Triage Analysis #
99

10-
* Simple Search
11-
* Collect Strings
12-
* Check AV vendors
13-
* Get basic PE information
14-
* Run it in a VM
15-
* Capture network information
10+
Depending on your workload, you want to spend the least amount of time trying to determine what the malware is doing and how to get rid of it. Many malware analysts use their own triage analysis, similar to that in the Emergency Room at the hospital.
11+
12+
You will want to quickly narrow down specific information and indicators before moving on to deeper static and dynamic analysis.
13+
14+
This checklist should get you started:
15+
- [ ] File Context and Delivery
16+
- [ ] File Information & Header Analysis
17+
- [ ] Get Basic PE information
18+
- [ ] Simple Search
19+
- [ ] Collect Strings
20+
- [ ] Check AV vendors
21+
- [ ] Quick VM Detonation
22+
- [ ] Capture network information
23+
24+
###File Context and Delivery
25+
26+
When you receive the malware binary, it's important to ask how the malware got there in the first place.
27+
28+
Questions to ask:
29+
* Did it come from an email?
30+
* Did it come from a browser download?
31+
* Was it quarantined in an Anti-Virus?
32+
* Is it an anomalous process running?
33+
34+
###File Information & Header Analysis
35+
36+
* Use a **file** command (sniffer VM) to determine the file type
37+
* Verify the file header using a hex editor (HxD)
38+
39+
###Get Basic PE information
40+
41+
* Parse the PE header using the tool CFF Explorer
42+
* Determine what resources, DLL imports, and libraries used
43+
* Example: If you see **Ws2_32.dll** it might be setting up a network connection because it's used for setting up sockets
44+
45+
###Simple Search
46+
47+
* Calculate the hash of the file an check the web to see if it's been seen already
48+
49+
###Collect Strings
50+
51+
* using the string command in linux or BinText tool, extract the strings to find any clues
52+
53+
###Check AV vendors
54+
55+
* Run the file against an Anti-Virus or VirusTotal to see if there are any detections
56+
57+
###Quick VM Detonation
58+
59+
* Use open source VM detonation services like hybrid-analysis.com or malwr.com to get the behavior quickly
60+
61+
###Capture network information
62+
63+
* Use the VM detonation service to capture any network connections or packet data.
64+
* If you can't do this then we will need to dynamically debug the malware.
65+
66+
## Malware Analysis Report
67+
68+
You will want to capture this information throughout your investigation either through notes or report documents.
69+
You can use the **Malware Analysis Report** template [HERE](https://securedorg.github.io/ReportForm.html)
70+
1671

1772
[Section 3 <- Back](https://securedorg.github.io/RE101/section3) | [Next -> Section 5](https://securedorg.github.io/RE101/section5)

0 commit comments

Comments
 (0)