CTF malware analysis
In-depth reference
The following reference materialsload on demand, and select the corresponding file according to the specific direction identified:
Classification decision tree
恶意软件分析题？
├─ 脚本类
│ ├─ JS → eval 替换为 console.log → 解码 unescape/atob
│ ├─ PowerShell → -enc base64解码 → IEX 替换为输出
│ ├─ Bash → eval 替换为 echo → base64/hex 提取
│ └─ Debian包 → ar -x → 检查 postinst 脚本
├─ 二进制类
│ ├─ PE → peframe/pestudio 快速分类 → [references/pe-and-dotnet.md](references/pe-and-dotnet.md)
│ ├─ .NET → dnSpy 反编译 → AsmResolver 编程分析
│ ├─ PyInstaller → pyinstxtractor 提取 → PyArmor 脱壳
│ └─ 查加密常量: AES S-box(0x637c777b) / ChaCha20 / TEA(0x9E3779B9) / RC4
├─ 流量分析
│ ├─ PCAP → tshark 提取流 → 识别 C2 模式
│ ├─ 自定义加密 → 找密钥 → 按时间序拼接解密
│ ├─ DNS C2 → 域名编码 / DGA 模式
│ └─ RC4 WebSocket → tcprewrite 重映射端口 → 找RC4密钥
├─ 反分析检测
│ ├─ VM检测 → CPUID/MAC/注册表/磁盘大小
│ ├─ 调试器 → PEB/时间检测/API哈希
│ └─ 进程注入 → hollowing/APC/CreateRemoteThread
└─ 内存取证 → vol3 malfind + YARA 扫描
Quick analysis commands
# 文件快速分类
file malware && strings -n 8 malware | head -50
# 提取网络指标
strings malware | grep -E '[0-9]{1,3}(\.[0-9]{1,3}){3}'
# PCAP 流量分析
tshark -r capture.pcap -Y "tcp.stream eq 0" -T fields -e tcp.payload
# PE 分析
peframe malware.exe
# 内存取证
vol3 -f memory.dmp windows.malfind
vol3 -f memory.dmp windows.pstree
Encryption algorithm identification
| Features |
Algorithm |
S-box 0x637c777b |
AES |
expand 32-byte k |
ChaCha20 |
0x9E3779B9 |
TEA/XTEA |
| 256-byte S-box sequential initialization |
RC4 |
| MD5/SHA256 (hardcoded strings) |
AES-CBC key derivation |
YARA quick reference
rule XOR_Loop { strings: $xor = { 31 ?? 80 ?? ?? 4? 75 } condition: $xor }
Deobfuscation techniques
| Language |
Method |
| JavaScript |
eval → console.log |
| PowerShell |
-enc base64 decoding / IEX → Output |
| Bash |
eval → echo |
| Junk code |
Filter NOP/push-pop/dead writes → extract real calls |
Shellcode analysis
objdump -b binary -m i386:x86-64 -D shellcode.bin # 反汇编
# Unicorn 模拟执行 / Capstone 编程反汇编
PowerShell obfuscation
- Multi-layer nested encoding, requires recursive decoding (possibly multiple layers of obfuscation)
C2 traffic analysis
- DNS C2: check subdomains (subdomain), encoded data in qname query domains
