[lick92005]

Hey everyone,

I am currently doing some research on detecting malware obfuscation and I am interested in any techniques or ideas that you all may have!

Specifically I am interested in detecting (Note: I am not interested in hiding data in images, just the detection of hidden data) the use of Steganography to hide malicious payloads in image files.

From my research I have learned that this is often done by modifying the least significant bits of the image data to encode programs or code snippets in images, this data is then able to be read by an external program.

The problem that I am running into is that oftentimes when data is hidden in an image it is also encrypted, now, I really don't care to learn what the contents of the hidden code is, the presence of any hidden code at all is enough for me to classify a given image as malicious. Why encrypted data is a problem for me is that I cant programmatically examine the bits to pattern match for strings because the encryption scrambles any keywords that I would be looking for.

The only thing that I can think of to detect hidden encrypted data in an image file would be to do some sort of entropy measurements on the image itself, because I postulate that images with higher entropy may have contain hidden data. This would require some novel approach to computing entropy because in my initial research I have found that the overall entropy of image data varies widely. One novel approach I have though of is measuring entropy of n-side-by-side pixels because oftentimes pixels that are sitting directly adjacent to each other will have the exact same RGB values and in an image with hidden data you may find few or no adjacent pixels with exact RGB value matches due to data being hidden in the least significant bits.


If anyone has any ideas for me please post here so we can discuss, this post was a stream of consciousness type post so I apologize if it is difficult to read.

Thanks!

[V3xD]

I understand youre looking for help finding and analyzing hidden malicious modifications of programs/images with stenography, heres an idea that may help i will use moddifying of crypter stubs as an example i understand thats not specifically what youre asking but im using it as an example to show how you could use the tool to detect changes and analyze them more.

Binary diffing is a method for detecting changes in files. This methods widely used malware analysis and exploit development while analysing patches. Thanks to binary differs, we dont have need to analysis same code again and again.

Bindiff is best tools for binary diffing IMHO. In this post we'll see how to use Bindiff plugin with IDA Pro. You can install Bindiff from its official web site ,it is free now.

In this example we'll diff two stubs of a succesful crypter.

Open first binary file in IDA. Wait until analysis finish
Then click Edit->Plugins->BinExport
Click "DifferDeluxe binary export" and save to file.

Open second binary file and do same operations for that.
Now we have two .BinExport file.

Open BinDiff.
Create new workspace with File -> New Workspace
Now we will add binexport files to diff. Click Diffs -> New Diffs. It will ask for Primary and Second Source give previously created binexport files as input respectively. Then click Diff.


That's all now we can view results with double-clicking File names in Workspace windows.

You can see that our stub files have 83 common functions. There are 13 functions that unique for first stub and 19 functions that unique for second stub.

If we view details of matching functions with double clicking it.



With double clicking functions names you can disassemble and compare them.


Now we can detect loader part of crypter with analysing matching functions. Also we can try to understand how junk codes used. is developer just shuffle them or it add new junk codes. etc

I understand you're not working with stubs, but i would assume you could use this same method between files to see where and how it was modified with stenography, this can show you where and how the file was modified so that you can analyze it more. I hope i helped.

[gemtau]

will BinExport work for Ida Freeware . i have tried copying dll from github but its showing up in IDA window