Latest Updates of VxStream Sandbox and the Malware Analysis Service at Hybrid-Analysis.com

A previous blogpost published at the beginning of February outlined some of the new features that were added to our online malware service. We have added quite a lot of functionality since then and think it is a good idea to post a brief summary of what that is exactly to keep our readers and users up-to-date.

 

Updated Anti-VM Technology

After Pafish v0.4 (a benchmarking tool that implements common VM detection methods) was released earlier this year, we updated our anti-vm technology to be up-to-date and made a small benchmark of some popular malware analysis services at the same time. Today, Pafish v0.5 was released and we will start working on our anti-vm technology in the coming weeks and keep you updated on any progress.

 

Improved Searching Capabilities

We improved the webservice search and added some more advanced search options. On the previous version, you were able to search by filename, MD5 or SHA256 hash. Now, you can also search for a virus family name, all reports that contacted a specific host IP address or domain. Examples:

• host:95.181.53.78
• domain:checkip.dyndns.org
• vxfamily:upatre

Please note: if only one result is returned by the search, you are automatically redirected to the report. Also, the vxfamily search is a substring search and applies only to the VxStream determined virus family name. All search results are limited to at most 100.

Also, some of the new searching capabilities were integrated into all online reports with direct links, so you can continue navigating to other reports by clicking the virus family name or quickly find other reports with common network destinations (see the following image).

 

Updated VBA Macro Parsing

As we had been getting more and more uploads of Word files and malicious XML files (and not all of them triggered or showed outgoing network traffic), we spent some time and added a small VBA "de-obfuscating" engine that helps extracting C2 IPs regardless of the runtime behavior. We made a blogpost about it last week that received good feedback and is showing some good results so far. After we published the blogpost, Philippe Lagadec announced that he is working on a generic engine that does the same and more - so we are looking forward to that development and will keep you updated on any progress.

 

Other updates not mentioned anywhere

Of course, we also make updates that are not published as part of blogposts or mentioned in the FAQ page of the service, because it would take too much time and not everything is really significant. Some of these updates over the past week included:

• we added new YARA signatures that run on all input samples (we have ~600 online right now)
• we have been adding more generic behavior signatures (we have ~215 online right now)
• we added a webservice statistics page to clean up the front page, which tells you the current status of the number of signatures loaded by the system
• we added support for MIME types (i.e. you can upload a MIME type and the service will "unmime" it and analyze a valid file, if it is embedded)
• we added "environment groups" (multiple systems) that can be selected from if you upload a file
• we added some Windows 8.1 VMs
• we added the ability to "not share" a sample when submitting (it is not available for download and not uploaded to VirusTotal, if unknown)
• we added a download for strings detected in-memory
• we added shellcode streams that are extracted from memory written to foreign processes
• we brushed up the visuals a bit, especially the submissions list that contains a lot more information now

.. and a few other minor things that should not be mentioned here.

VxStream Sandbox and Hybrid-Analysis.com - Free Malware Analysis - Evolution

What's been happening?

This blogpost will focus around the evolution of the online webservice, the cool features we added over the past weeks and demonstrate them on a couple of real world samples.

In the middle of November last year (so about 10 weeks ago) the automated malware behavior analysis service at www.hybrid-analysis.com was released to the public and since then the delicate flower has been starting to blossom a bit.

So far we've had about a bit more than 2000 analyses with ~1900 unique files, more than 25k behavior signatures matched and we had 50k page views with 6k unique sessions from 107 different countries accessing our service. The overall bounce rate is only 54% with 38% returning visitors, so we have been addressing a targeted audience. This is how the world map looks, if you colorize countries by their frequency of access to the webservice (taken from Google Analytics):

We've also been noticing that people have been using our service more and more frequently during the "work days", so it is a good sign that people are utilizing our service at a professional level:

Also, we received quite a lot of feedback and feature suggestions, that we would like to present to you in the following. Our conclusion so far: we must be doing something right.

New Major Features

Let me start out saying: we added a lot. So many features, that we decided to address only the most important ones.

Supported File Types

Right from the beginning, we had a lot of documents/PDF files being uploaded that weren't supported at first, so we focused on adding to the list of supported file types. Right now you can upload any of the following filetypes:

Documents (new!): .doc, .docx, .rtf, .xls, .xlsx, .ppt, .pptx, .pdf

Executables: any kind of Windows PE file (.exe, .scr, .dll, .pif, .com, etc.).

All of the file types are detected automatically, so you can have any suffix, it will be ignored anyway. As we also had some users request to upload their files in different archive formats, we added support for some common archive types. Right now, you can upload any archive with or without the standard password ('infected') with the following archive format:

zip, 7z, xz, bzip2, gzip2, tar, wim

We also added support for uploading multiple files in a single archive. For more information on the special syntax required, please get in touch with us using the contact form on our company webpage.

Extended Document Parsing

Of course, an analysis system could just open e.g. a WORD document file and simply watch what's happening (network traffic, dropped files or new processes being created). Often though this approach requires a potentially embedded exploit to trigger, so we added parsers that extract VBA macros or embedded Javascript in PDF files for which the extracted data is piped to our signature interface. This comes in handy, especially if the document exploit doesn't trigger, because e.g. the shellcode/macro itself often contains valuable indicators already, even if it is obfuscated.

Here is an example of VBA macro extraction:

Click here to view the full report on Hybrid-Analysis.com

Improved YARA integration

One of our users creates YARA signatures based on extracted process memory strings, so we extended our YARA integration to run especially on these kind of strings to demonstrate the functionality. Actually, we use the small set of YARA rules in-place now to classify RATs:

Click here to view the full report on Hybrid-Analysis.com

Parsing Screenshots using Optical Character Recognition (OCR)

Although this idea isn't new, we decided to add some simple OCR parsing of the screenshots our analysis system takes in order to demonstrate how easy it is to add a complex process into the existing system and achieve a result that - due to its generic character - will apply also to unknown samples in the future.

Click here to view the full report on Hybrid-Analysis.com

Brushed-up the "Extracted Strings" section

Another nice addition was the brush-up of the extracted strings section, which now includes multiple tabs that list a pre-selected subset of all strings, strings extracted from screenshot parsing, strings extracted from a dropped file/the input sample (binary scan) or strings from the various analyzed processes. With the ability to download all memory-extracted strings we think the new "Extracted Strings" section adds more depth and overview. If you click the "Details" button, more information on the origin of the string (what type of file or event was the cause) is displayed:

Behavior Signatures

Our "daily business" is to add behavior signatures, as they trigger on a variety of different events and offer a quick overview and valuable indicators at the same time. Signatures can trigger on registry accesses, file operations, on strings, created mutants, a specific API call, on AV test results, extracted instructions from our disassembly "streams", and so forth and so on. We have been adding a lot of signatures since the service started (old report run-throughs might not include all the latest and greatest) and nearly doubled our signatures in-place with 180+ signatures serving right now. If you come by a sample that shows behavior you believe is not being reflected by a signature (i.e. you think a specific signature is missing), just let us know and we will add it if possible.

Summary

In this blogpost we presented the major features that were added over the past weeks to the service and sandbox system. Of course, we also had a lot of other smaller features/visual improvements that we implemented to the reports silently (e.g. the display on tablets/mobile phones) and improved the runtime monitor (e.g. better .NET sample loading and monitoring of system processes), but it would be out of the scope of this blogpost to list every tine addition/change. Overall, we believe that our system is moving in the right direction, also based on the feedback we have been getting. We have a very ambitious roadmap for 2015 and will let you know when we reach our next milestone.

We hope you enjoyed this brief summary and continue using our free service and don't stop on the feedback.

One last advertising side-note: If you are interested in purchasing the full version for an on-premise installation (the entire system is available as a standalone) and/or want to run your own private cloud service, please get in touch using our contact form and we will get back to you with more details.

New Feature Benchmark and first Report UI Preview

This will be just a very short blogpost. Our VxStream Sandbox malware analysis system development process is progressing well. Currently, we have completed development of a Beta Version that is being tested on large scale systems and released a feature product comparison chart to give people an idea of what will be included in the first version. Go and check it out at our new VxStream product page.

Preview On VxStream Sandbox Automated Malware Analysis System

Last month we published an article "Hybrid Analysis - NextGen Technology for Advanced Malware Payload Detection" that outlined our StaticStream core engine and also appeared in the July's edition of the Hakin9.org magazine. It outlined some aspects of automated malware analysis systems, specifically that the "NextGen" automated systems will require a combination of dynamic and static analysis techniques in the future, because VM detection on the malware end is growing stronger and the preset environment does not always meet the conditions to trigger the interesting payload. In other words, it is important to detect and analyze non-executed code sequences at runtime. We understand this requirement and since we have been building on some in-house tools to extract run-time data from malware decided to take things one step further and automate the process, creating a fully automated malware analysis system that we call VxStream Sandbox, to a degree borrowing its name from the "streaming architecture" of StaticStream that is a core and integral part of the overall system. In this blogpost, we will outline some of the features the new system has and give a brief overview.

Description

In-depth analysis of 32-bit executables on all compatible Windows Operating Systems

High-speed algorithms that allow in-depth analysis within minutes

Flexible hooking system to monitor run-time behavior

Intelligent process monitoring that follows malware injecting into system/user processes

Implements common anti-VM detection techniques (e.g. undetectable to paranoid fish)

Hybrid Analysis integrated (combination of static and dynamic analysis)

Dormant code detection based on executed function calls

Injected memory logging for in-depth analysis (shellcode detection)

API calls with parameter values/names, register values and call stack

Full Registry access, Process Handles, Mutants, etc. monitoring

Memory snapshots to detect unpacked code during runtime

Open and configurable behavior signatures, add your own signatures

Third-party integration of e.g. YARA signatures possible

Extensive pure static analysis on sample (imphash, ssdeep, etc.)

Unique screenshot detection

Dropped/created file detection for multi-stage analysis

Network traffic filters and extraction of key data (HTTP request/contacted hosts)

Extensive XML and JSON reports for post-processing

Optional (automatic) persistence of reports into supported databases

Wide range of configuration options and logging features

As we can see, the list of features is already quite extensive, but there is always room for improvement. Since we are very convinced of (and seen already) the real-world practicability of our software system, we are going to invest more resources into taking it to the next level.

The following diagram outlines the overall system quite well (from a "birds perspective"):

As we can see, it is quite straightforward and the general data processing (with parallelization) is the conversion of an input sample to an in-depth report that is machine parsable. Of course, the behavior signatures that are applied to the extracted run-time and static analysis data are configurable, are ever-growing by nature of malware forensics and can be shared amongst users.