Improved webservice statistics and a new feature called 'Behavior Chronology'

Actually, we had meant to use this blogpost to write about specific malware samples and forensic investigation techniques applied to such specific samples, but our latest development tasks are taking up all the time of the team right now. Since we don't want our users to miss out on any of the latest additions, we are going to briefly outline some new features in yet another update blogpost.

Webservice Statistics

We made a complete 'rehaul' of the webservice statistics page. It is something we had been planning to do, because there is some really neat things possible using the report data - and now that we have more than 8000 reports in our database - we thought the time was ripe. Over time, we will surely add more and different output, so this is really just an introduction. The new webservice statistics include information on:

• Potentially Interestings Samples (Original AV% < 10 with Threat Score > = 80)
• A nice area spline that shows the reports generated over the past 100 days
• The top 20 file types processed on the webservice
• The top 20 file packers detected on the webservice
• The top 20 virus families detected on the webservice
• A new 'AV Detection Distribution' that shows how many AVs trigger on a given sample (e.g. only 2% of the time more than 90% agree a file is malicious)
• A top/bottom statistic of matched signatures (with a search link if you hover the pie)
• Some additional facts (like the % of users sharing samples with the community)

What we really like the most is the 'Potentially Interesting Samples' section, because it is a really fast way to dive into reports that might contain something new (and these reports usually underline the strengths of a sandbox system). Why? Because if the AV detection is 'low' (it's usually always the same candidates that perform well) and the 'Threat Ratio' (which is calculated by our sandbox system and mainly based on the behavior signatures and a predefined relevance) is high, the input sample is probably a new variant or implementing some interesting tricks to avoid AV detection.

A nice 'fun fact' is that nearly 80% of all uploaded samples are also shared with the community. We think that is really a great positive signal and shows the character of the IT-Security community (at least of our users).

Behavior Chronology

This feature is really new and was actually added to all new generated reports this morning. Basically, it's a new diagram that puts behavior signatures which are based on some kind of 'time-related event' (like an API call, a registry access or file event) in a chronological order, specifically by the first time the associated signature triggered. This is not per-process, but a very global view on what is happening on the underlying system. The following diagram shows an example:

Hovering over some of the bubbles (by the way: their size is based on the relevance of the associated signature), we can quickly get a brief impression on what the file is doing. At the beginning, it queries the machine version, the windows account name, etc., then it starts sleeping for a long time and eventually prepares some internet related things (modifying the proxy settings) and persists itself. Here is a link to the report associated with the diagram above. This global perspective (as it's not per-process) on specific behavior 'events' (especially with our growing signature database) should give some unique and added insights into the 'what happens when' part of investigation. Also, some meta-signatures that could trigger when detecting specific event sequences could be added in a future version. Either way, in our opinion the feature shows that automated malware analysis and digital forensics is an 'open end' topic and there's so many things still waiting to be implemented.

If you have any questions or would like to make feature suggestions, feel free to use our contact form and we will get back to you shortly.

Welcome Hybrid-Analysis.com - Free Malware Analysis Service

Today we are proud to announce that a Beta version of VxStream Sandbox has been launched as part of our new malware analysis webservice at hybrid-analysis.com. This will remain a free service for everyone and it will give people an idea of our innovative Hybrid Analysis technology. The service is an ongoing project and is likely to receive feature updates in the future. Please keep in mind that it is a new service and needs time to develop.

Update: We just updated our service, improving some bugs with the network traffic display, the stability of the runtime monitor and a few other minor issues (the parameter values are now displayed in hexadecimal). Right now we are re-running the 100+ unique samples we received in the last 24 hours to update all reports. We will only be doing this during the initial phase, as re-running 100 samples takes only about 30 minutes, but later it would stall the system too much. Have fun!

New Feature Benchmark and first Report UI Preview

This will be just a very short blogpost. Our VxStream Sandbox malware analysis system development process is progressing well. Currently, we have completed development of a Beta Version that is being tested on large scale systems and released a feature product comparison chart to give people an idea of what will be included in the first version. Go and check it out at our new VxStream product page.

Preview On VxStream Sandbox Automated Malware Analysis System

Last month we published an article "Hybrid Analysis - NextGen Technology for Advanced Malware Payload Detection" that outlined our StaticStream core engine and also appeared in the July's edition of the Hakin9.org magazine. It outlined some aspects of automated malware analysis systems, specifically that the "NextGen" automated systems will require a combination of dynamic and static analysis techniques in the future, because VM detection on the malware end is growing stronger and the preset environment does not always meet the conditions to trigger the interesting payload. In other words, it is important to detect and analyze non-executed code sequences at runtime. We understand this requirement and since we have been building on some in-house tools to extract run-time data from malware decided to take things one step further and automate the process, creating a fully automated malware analysis system that we call VxStream Sandbox, to a degree borrowing its name from the "streaming architecture" of StaticStream that is a core and integral part of the overall system. In this blogpost, we will outline some of the features the new system has and give a brief overview.

Description

In-depth analysis of 32-bit executables on all compatible Windows Operating Systems

High-speed algorithms that allow in-depth analysis within minutes

Flexible hooking system to monitor run-time behavior

Intelligent process monitoring that follows malware injecting into system/user processes

Implements common anti-VM detection techniques (e.g. undetectable to paranoid fish)

Hybrid Analysis integrated (combination of static and dynamic analysis)

Dormant code detection based on executed function calls

Injected memory logging for in-depth analysis (shellcode detection)

API calls with parameter values/names, register values and call stack

Full Registry access, Process Handles, Mutants, etc. monitoring

Memory snapshots to detect unpacked code during runtime

Open and configurable behavior signatures, add your own signatures

Third-party integration of e.g. YARA signatures possible

Extensive pure static analysis on sample (imphash, ssdeep, etc.)

Unique screenshot detection

Dropped/created file detection for multi-stage analysis

Network traffic filters and extraction of key data (HTTP request/contacted hosts)

Extensive XML and JSON reports for post-processing

Optional (automatic) persistence of reports into supported databases

Wide range of configuration options and logging features

As we can see, the list of features is already quite extensive, but there is always room for improvement. Since we are very convinced of (and seen already) the real-world practicability of our software system, we are going to invest more resources into taking it to the next level.

The following diagram outlines the overall system quite well (from a "birds perspective"):

As we can see, it is quite straightforward and the general data processing (with parallelization) is the conversion of an input sample to an in-depth report that is machine parsable. Of course, the behavior signatures that are applied to the extracted run-time and static analysis data are configurable, are ever-growing by nature of malware forensics and can be shared amongst users.