{"id":576,"date":"2016-10-17T12:16:41","date_gmt":"2016-10-17T12:16:41","guid":{"rendered":"http:\/\/www.adlice.com\/?p=576"},"modified":"2022-12-21T10:36:17","modified_gmt":"2022-12-21T10:36:17","slug":"adlice-peviewer-bring-parsing-next-level","status":"publish","type":"post","link":"https:\/\/www.adlice.com\/es\/adlice-peviewer-bring-parsing-next-level\/","title":{"rendered":"Adlice PEViewer : Bring Analysis to the Next Level"},"content":{"rendered":"\n

Adlice PEViewer (formerly RogueKillerPE)<\/a> is a PE parsing tool, helping researchers during a sample analysis to determine if a sample is malicious<\/strong> and if yes, also gives hints on how to make a signature<\/strong> for it.<\/p>\n\n\n\n


Overview<\/h2>\n\n\n\n

The general tab (overview) is like the sample’s face<\/strong>. It’s intuitive, and most of the time sufficient to know if a sample is malicious. You can see the icon, the PEViewer score as well as VirusTotal’s score, packer and compiler used, and digital signature<\/strong>.<\/p>\n\n\n\n

In the example below, we can see it’s hidding behind a MP3 icon<\/strong> and use a PE Packer<\/strong>.<\/p>\n\n\n\n

We can also see there’s an error in the digital signature<\/strong> (0x800b010c – A certificate was explicitly revoked by its issuer), due to a stolen (revoked) certificate<\/strong>. And overall, it’s 94% malicious and 34\/57 on VirusTotal<\/strong>. No doubt, it’s malicious.<\/p>\n\n\n\n

\"rkpe_1\"<\/a><\/figure>\n\n\n\n


Indicators<\/h2>\n\n\n\n

Indicators are displayed in the special tab, with a red color for negative impact, and green for positive impact<\/strong>. They all have score and weight<\/strong>, and the addition of all of them gives a global maliciousness score. Here’s an example of some of them:<\/p>\n\n\n\n

\"rkpe_2\"<\/a><\/figure>\n\n\n\n


Digital Signature<\/h2>\n\n\n\n

Digital signature<\/a> can be of some help<\/strong> to get an idea of the maliciousness of a sample. It is summarized in the General tab, like seen before, but is fully detailed in the Digital Signature tab<\/strong>. In the case of the following sample, the certificate has been stolen and since revoked by Sierry Wireless, Inc. (again the error 0x800b010c).<\/p>\n\n\n\n

\"rkpe_3\"<\/a><\/figure>\n\n\n\n
\"rkpe_4\"<\/a><\/figure>\n\n\n\n


Legit sample<\/h2>\n\n\n\n

To see the actual difference (of score) with a legit sample<\/strong>, let’s take a look at Avast UI file<\/a>. We can see something extremely useful in case of a malware, the PDB path<\/strong>. Also, since here the digital signature is valid we can see the issuer in the General tab<\/strong>. The sample reaches an overall maliciousness score of 36%<\/strong>, which is quite low (could have been better, but the file contains an overlay and calls suspicious kernel APIs).<\/p>\n\n\n\n

\"rkpe_5\"<\/a><\/figure>\n\n\n\n


Links<\/h2>\n\n\n\n