Tên biến Mục dích
ANALYSIS_DIR Thư mục để chứa các report về malware, mỗi thư mục cấp dưới với md5 của malware là thư mục report về malware đã phân tích.
SHARED_FOLDER Thư mực sử dụng để chia sẻ malware cần phân tích giữa mỗi trường Linux và Windows. Malware sẽ được copy đến đây và từ đây sẽ map sang môi trường Windows.
INETSIM_DIR Thư mục cài đặt InetSim
VM_LOAD_TIMEOUT Biến sử dụng để định thời gian load của máy ảo, tùy thuộc vào khả năng load của máy ảo có thể tăng hoặc giảm thời gian timeout, đơn vị thời gian là giây
MALWARE_RUNTIME Là thời gian cho phép malware sẽ thực hiện trên máy ảo, đơn vị tính là giây
TIMEOUT Số lượng thời gian mà script sẽ đợi cho việc dynamic analysis hoàn tất
… Một số biến khác sẽ rõ trong quá trình giải thích chi tiết kịch bản.

#Kiểm tra nếu như đối số 1 rỗng (tức không chỉ định malware cần phân tích) hoặc file đó không tồn tại và không đọc được thì thông báo và thoát
if [ ! -n "$1" -o ! -r "$1" ]
then
echo "Usage: 'basename $0' executable"
exit
fi
if [ ! -d ${SHARED_FOLDER} ]
then
mkdir -p ${SHARED_FOLDER}
fi
MALWARE="$1"
MD5=`md5sum ${MALWARE} | awk '{print $1}'`
# Malware sẽ được đặt trong thư mục $ANALYSIS_DIR/$MD5 của nó.
if [ -d ${ANALYSIS_DIR}/${MD5} ] ; then
echo "${ANALYSIS_DIR}/${MD5} already exists. Exiting."
exit
fi
OUTDIR="${ANALYSIS_DIR}/${MD5}"
echo ${MALWARE} ${MD5} >> ${ANALYSIS_DIR}/records.txt
echo `date +"[%F %T]"` Starting analysis on ${MALWARE}.
echo `date +"[%F %T]"` Results will be placed in ${OUTDIR}
echo
mkdir ${OUTDIR}
REPORT=${OUTDIR}/${REPORT_NAME}

# Static Analysis
echo -e "Analysis of ${MALWARE}\n" > ${REPORT}
echo "MD5 Hash: ${MD5}" >> ${REPORT}
echo "Team Cymru Hash Database:" >> ${REPORT}
whois -h hash.cymru.com ${MD5} >> ${REPORT}
# grab both ASCII and UNIcode strings from the sample
echo `date +"[%F %T]"` Running strings.
(strings -a -t x ${MALWARE}; strings -a -e l -t x ${MALWARE}) \
| sort > ${OUTDIR}/strings.txt
# run pecheck.py
echo `date +"[%F %T]"` Running pecheck.py.
python pecheck.py -d ${PEID_DB} ${MALWARE} > ${OUTDIR}/pecheck.txt

echo `date +"[%F %T]"` Starting InetSim.
CWD=`pwd`
mkdir -p ${OUTDIR}/inetsim
cd ${INETSIM_DIR}
sudo ./inetsim --session inetsim --config ${INETSIM_DIR}/conf/inetsim.conf \
--log-dir ${OUTDIR}/inetsim --report-dir ${OUTDIR} > /dev/null & cd ${CWD}

echo `date +"[%F %T]"` Starting tcpdump.
sudo tcpdump -i vmnet1 -n -s 0 -w ${OUTDIR}/tcpdump.pcap &
TCPPID=`jobs -l | grep "sudo tcpdump" | awk '{ print $2 }'`

# Start up VMWare
# First we revert to our base snapshot
vmrun revertToSnapshot "/root/vmware/MalwareAnalysis/sandbox.vmx" base
# Then we start VMWare running
echo `date +"[%F %T]"` Starting VMWare.
vmrun start "/root/vmware/MalwareAnalysis/sandbox.vmx"
sleep ${VM_LOAD_TIMEOUT}
# Move the malware over to the sandbox
cp ${MALWARE} ${SHARED_FOLDER}/malware.exe
# Set up the share and execute the AutoIT script
echo `date +"[%F %T]"` Setting up network share.
winexe -U WORKGROUP/analysis%analysis --interactive=1 --system //192.168.32.2 'cmd /c net use z: \\192.168.32.1\malware'
echo `date +"[%F %T]"` Starting dynamic analysis script.
winexe -U WORKGROUP/analysis%analysis --interactive=1 --system //192.168.32.2 "c:\progra~1\autoit3\autoit3.exe c:\tools\scripts\analyze.au3 z:\malware.exe z:\ ${MALWARE_RUNTIME}"
sleep ${MALWARE_RUNTIME}
LOOP=0
echo `date +"[%F %T]"` Starting check for finished file.
# Check for finished file - if not there, wait
while [ ! -f ${SHARED_FOLDER}/_analysis_finished ] ; do
echo Checking...
sleep ${TIMEOUT}
LOOP=$(( $LOOP + 1 ))
if [ ${LOOP} -gt 5 ] ; then
echo `date +"[%F %T]"` ERROR: Sandbox is hung.
break;
fi
done
# Remove the share
echo `date +"[%F %T]"` Removing network share.
winexe -U WORKGROUP/analysis%analysis --interactive=1 --system //192.168.32.2 'cmd /c net use z: /delete'
# Stop the VMWare Image
echo `date +"[%F %T]"` Suspending VMWare.
vmrun suspend "/root/vmware/MalwareAnalysis/sandbox.vmx"

# Run Volatility on memory
echo `date +"[%F %T]"` Starting Volatility psscan2.
python /usr/local/src/Volatility-1.3_Beta/volatility psscan2 -f "/root/vmware/MalwareAnalysis/sandbox.vmem" \
> ${OUTDIR}/volatility-psscan.txt
echo `date +"[%F %T]"` Starting Volatility connscan2.
python /usr/local/src/Volatility-1.3_Beta/volatility connscan2 -f "/root/vmware/MalwareAnalysis/sandbox.vmem" \
> ${OUTDIR}/volatility-connscan2.txt
echo `date +"[%F %T]"` Starting Volatility dlllist.
python /usr/local/src/Volatility-1.3_Beta/volatility dlllist -f "/root/vmware/MalwareAnalysis/sandbox.vmem" \
> ${OUTDIR}/volatility-dlllist.txt
echo `date +"[%F %T]"` Starting Volatility modscan2.
python /usr/local/src/Volatility-1.3_Beta/volatility modscan2 -f "/root/vmware/MalwareAnalysis/sandbox.vmem" \
> ${OUTDIR}/volatility-modscan2.txt
# Move Results
echo `date +"[%F %T]"` Cleaning up.
mv ${SHARED_FOLDER}/* ${OUTDIR}

# Stop tcpdump. Since its running as root we need to sudo to kill it
if [ ! -z ${TCPPID} ]; then
sudo kill ${TCPPID}
fi
# Stop InetSim
if [ -f /var/run/inetsim.pid ] ; then
INETPID=`cat /var/run/inetsim.pid`
sudo kill ${INETPID} > /dev/null
wait ${INETPID}
fi
# check to see if malware.exe is in the outdir - if so, delete it
if [ -f ${OUTDIR}/malware.exe ]; then
rm -f ${OUTDIR}/malware.exe
fi
# Reset permissions on the files
sudo chown -R ${WHOAMI} ${OUTDIR}
echo `date +"[%F %T]"` Analysis finished.

; AutoIT Windows Malware Automation Script
Func startRegshot($logDir)
; Start up regshot as user analysis
RunAs("analysis","","analysis",0,"c:\tools\regshot\regshot.exe")
WinActivate("Regshot")
WinWaitActive("Regshot")
; set to plain text
ControlClick("Regshot","Plain &TXT","Button7")
; set scan dir info
ControlClick("Regshot","&Scan dir1","Button9")
ControlClick("Regshot","",1027)
send("{HOME}")
send("{LSHIFT}+{END}")
send("c:\")
; set output dir
ControlClick("Regshot","",1026)
send("{HOME}")
send("{LSHIFT}+{END}")
send($logDir)
; set the comment
ControlClick("Regshot","",1025)
send("regshot")
; Start the scan
ControlClick("Regshot","&1st shot","Button1")
send("s")
; wait until the scan is done or 30 seconds
WinWaitActive("Regshot","Dirs:",30)
EndFunc
Func stopRegshot()
; WinWaitActive("Regshot")
WinSetState("Regshot","",@SW_RESTORE)
WinActivate("Regshot")
; stop the scan and run the second shot
WinWaitActive("Regshot")
ControlClick("Regshot","&2nd shot","Button2")
send("s")
; now compare
WinActivate("Regshot")
WinWaitActive("Regshot","c&Ompare",10)
send("o")
; Wait for notepad to pop up
WinWait("[CLASS:Notepad]", "")
WinActivate("[CLASS:Notepad]", "")
WinClose("[CLASS:Notepad]", "")
; Close Regshot
WinActivate("Regshot")
WinClose("Regshot")
EndFunc
Func startProcmon()
; Start ProcMon
; Run Procmon as user analysis
RunAs("analysis","","analysis",0,"c:\tools\procmon\procmon.exe")
WinWaitActive("Process Monitor - Sysinternals: www.sysinternals.com")
EndFunc
Func stopProcmon($logDir)
; stop procmon
WinActivate("Process Monitor")
; stop procmon with a CTRL+e and wait for it to finish
Send("^e")
WinWaitActive("Process Monitor - Sysinternals: www.sysinternals.com")
; save the captured data with CTRL+s
Send("^s")
WinActivate("Save To File","Events to save:")
ControlSetText("Save To File","Events to save:",1027,$logDir & "procmon.csv")
; save the output in CSV format
ControlClick("Save To File","Events to save:","Button7")
ControlClick("Save To File","Events to save:",1)
; If the file already exists, overwrite it
if WinWaitActive("Process Monitor","&Yes",1) Then
ControlClick("Process Monitor","&Yes","Button1")
EndIf
WinClose("Process Monitor - Sysinternals: www.sysinternals.com")
EndFunc
; Main Function
; There are 2 options required – make sure they are there
If $CmdLine[0] <> 3 Then
msgbox(4096,"ERROR","Usage: malware.exe dir_to_log pause_time",10)
Exit
EndIf
; The malware to execute is the 1st parameter
$malware=$CmdLine[1]
$runmalware="c:\tools\malware\malware.exe"
; The dir to log to is the 2nd parameter
$logdir = $CmdLine[2]
$saveresult=$logdir
$logdir="c:\tools\malware\"
; The time to pause (in seconds) is the last parameter
$pauseTime = $CmdLine[3]
; start our monitoring tools
filecopy($malware,$runmalware,1)
startRegshot($logdir)
startProcmon()
WinMinimizeAll()
; run the malware as user analysis
RunAs("analysis","","analysis",0,$runmalware)
; wait – note time is in milliseconds
sleep($pauseTime * 1000)
; stop our monitoring tools and save the results
stopProcmon($logdir)
stopRegshot()
FileDelete("z:\*.*")
filecopy("c:\tools\malware\*.*","z:\*.*",1)
; let them know we're finished by creating a FileChangeDir
$file=FileOpen($logdir & "_analysis_finished",10)
FileClose($file)
FileCopy($logdir & "_analysis_finished","z:\_analysis_finished",1)

# ----------------- Windows -----------------
# Windows TCP/IP stack is a mess. For most recent XP, 2000 and
# seem. Luckily for us, almost all Windows 9x boxes have an
8192:32:1:44:M*:.:Windows:3.11 (Tucows)
S44:64:1:64:M*,N,W0,N,N,T0,N,N,S:.:Windows:95
8192:128:1:64:M*,N,W0,N,N,T0,N,N,S:.:Windows:95b
# Windows 98 it is no longer possible to tell them from each other
S44:32:1:48:M*,N,N,S:.:Windows:98 (low TTL) (1)
8192:32:1:48:M*,N,N,S:.:Windows:98 (low TTL) (2)
%8192:64:1:48:M536,N,N,S:.:Windows:98 (13)
%8192:128:1:48:M536,N,N,S:.:Windows:98 (15)
S4:64:1:48:M*,N,N,S:.:Windows:98 (1)
S6:64:1:48:M*,N,N,S:.:Windows:98 (2)
S12:64:1:48:M*,N,N,S:.:Windows:98 (3
T30:64:1:64:M1460,N,W0,N,N,T0,N,N,S:.:Windows:98 (16)
32767:64:1:48:M*,N,N,S:.:Windows:98 (4)
37300:64:1:48:M*,N,N,S:.:Windows:98 (5)
46080:64:1:52:M*,N,W3,N,N,S:.:Windows:98 (RFC1323+)
65535:64:1:44:M*:.:Windows:98 (no sack)
S16:128:1:48:M*,N,N,S:.:Windows:98 (6)
S16:128:1:64:M*,N,W0,N,N,T0,N,N,S:.:Windows:98 (7)
S26:128:1:48:M*,N,N,S:.:Windows:98 (8)
T30:128:1:48:M*,N,N,S:.:Windows:98 (9)
32767:128:1:52:M*,N,W0,N,N,S:.:Windows:98 (10)
60352:128:1:48:M*,N,N,S:.:Windows:98 (11)
60352:128:1:64:M*,N,W2,N,N,T0,N,N,S:.:Windows:98 (12)
T31:128:1:44:M1414:.:Windows:NT 4.0 SP6a (1)
64512:128:1:44:M1414:.:Windows:NT 4.0 SP6a (2)
8192:128:1:44:M*:.:Windows:NT 4.0 (older)
# Windows XP and 2000. Most of the signatures that were
65535:128:1:48:M*,N,N,S:.:Windows:2000 SP4, XP SP1+
%8192:128:1:48:M*,N,N,S:.:Windows:2000 SP2+, XP SP1+ (seldom 98)
S20:128:1:48:M*,N,N,S:.:Windows:SP3
S45:128:1:48:M*,N,N,S:.:Windows:2000 SP4, XP SP1+ (2)
40320:128:1:48:M*,N,N,S:.:Windows:2000 SP4
S6:128:1:48:M*,N,N,S:.:Windows:XP, 2000 SP2+
S12:128:1:48:M*,N,N,S:.:Windows:XP SP1+ (1)
S44:128:1:48:M*,N,N,S:.:Windows:XP SP1+, 2000 SP3
64512:128:1:48:M*,N,N,S:.:Windows:XP SP1+, 2000 SP3 (2)
32767:128:1:48:M*,N,N,S:.:Windows:XP SP1+, 2000 SP4 (3)
# Windows 2003 & Vista
8192:128:1:52:M*,W8,N,N,N,S:.:Windows:Vista (beta)
32768:32:1:52:M1460,N,W0,N,N,S:.:Windows:2003 AS
65535:64:1:52:M1460,N,W2,N,N,S:.:Windows:2003 (1)
65535:64:1:48:M1460,N,N,S:.:Windows:2003 (2)
S52:128:1:48:M1260,N,N,S:.:Windows:XP/2000 via Cisco
65520:128:1:48:M*,N,N,S:.:Windows:XP bare-bone
16384:128:1:52:M536,N,W0,N,N,S:.:Windows:2000 w/ZoneAlarm?
2048:255:0:40:.:.:Windows:.NET Enterprise Server
44620:64:0:48:M*,N,N,S:.:Windows:ME no SP (?)
S6:255:1:48:M536,N,N,S:.:Windows:95 winsock 2
32000:128:0:48:M*,N,N,S:.:Windows:XP w/Winroute?
16384:64:1:48:M1452,N,N,S:.:Windows:XP w/Sygate? (1)
17256:64:1:48:M1460,N,N,S:.:Windows:XP w/Sygate? (2)
*:128:1:48:M*,N,N,S:U:-Windows:XP/2000 while downloading (leak!)
32768:32:1:44:M1460:.:Windows:CE 3
3100:32:1:44:M1460:.:Windows:CE 2.0
*:128:1:52:M*,N,W0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w, tstamp-)
*:128:1:52:M*,N,W*,N,N,S:.:@Windows:XP/2000 (RFC1323+, w+, tstamp-)
*:128:1:52:M*,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w-, tstamp+)
*:128:1:64:M*,N,W0,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w, tstamp+)
*:128:1:64:M*,N,W*,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w+, tstamp+)
*:128:1:48:M536,N,N,S:.:@Windows:98
*:128:1:48:M*,N,N,S:.:@Windows:XP/2000

# ----------------- Linux -------------------
S1:64:0:44:M*:A:Linux:1.2.x
512:64:0:44:M*:.:Linux:2.0.3x (1)
16384:64:0:44:M*:.:Linux:2.0.3x (2)
2:64:0:44:M*:.:Linux:2.0.3x (MkLinux) on Mac (1)
64:64:0:44:M*:.:Linux:2.0.3x (MkLinux) on Mac (2)
S4:64:1:60:M1360,S,T,N,W0:.:Linux:2.4 (Google crawlbot)
S4:64:1:60:M1430,S,T,N,W0:.:Linux:2.4-2.6 (Google crawlbot)
S2:64:1:60:M*,S,T,N,W0:.:Linux:2.4 (large MTU?)
S3:64:1:60:M*,S,T,N,W0:.:Linux:2.4 (newer)
S4:64:1:60:M*,S,T,N,W0:.:Linux:2.4-2.6
S3:64:1:60:M*,S,T,N,W1:.:Linux:2.6, seldom 2.4 (older, 1)
S4:64:1:60:M*,S,T,N,W1:.:Linux:2.6, seldom 2.4 (older, 2)
S3:64:1:60:M*,S,T,N,W2:.:Linux:2.6, seldom 2.4 (older, 3)
S4:64:1:60:M*,S,T,N,W2:.:Linux:2.6, seldom 2.4 (older, 4)
T4:64:1:60:M*,S,T,N,W2:.:Linux:2.6 (older, 5)
S4:64:1:60:M*,S,T,N,W5:.:Linux:2.6 (newer, 1)
S4:64:1:60:M*,S,T,N,W6:.:Linux:2.6 (newer, 2)
S4:64:1:60:M*,S,T,N,W7:.:Linux:2.6 (newer, 3)
T4:64:1:60:M*,S,T,N,W7:.:Linux:2.6 (newer, 4)
S20:64:1:60:M*,S,T,N,W0:.:Linux:2.2 (1)
S22:64:1:60:M*,S,T,N,W0:.:Linux:2.2 (2)
S11:64:1:60:M*,S,T,N,W0:.:Linux:2.2 (3)
S4:64:1:48:M1460,N,W0:.:Linux:2.4 in cluster
32767:64:1:60:M16396,S,T,N,W0:.:Linux:2.4 (loopback)
32767:64:1:60:M16396,S,T,N,W2:.:Linux:2.6 (newer, loopback)
S8:64:1:60:M3884,S,T,N,W0:.:Linux:2.2 (loopback)
16384:64:1:60:M*,S,T,N,W0:.inux:2.2 (Opera?)
32767:64:1:60:M*,S,T,N,W0:.inux:2.4 (Opera?)
S22:64:1:52:M*,N,N,S,N,W0:.:Linux:2.2 (tstamp-)
S4:64:1:52:M*,N,N,S,N,W0:.:Linux:2.4 (tstamp-)
S4:64:1:52:M*,N,N,S,N,W2:.:Linux:2.6 (tstamp-)
S4:64:1:44:M*:.:Linux:2.6? (barebone, rare!)
T4:64:1:60:M1412,S,T,N,W0:.:Linux:2.4 (rare!)
27085:128:0:40:.:.ellowerApp cache (Linux-based)