Lab 13: ️ Malware Static Analysis - Menganalisis File Mencurigakan Tanpa Eksekusi

cd ~ && mkdir forensics-lab13 && cd forensics-lab13

# 1. Buat file simulasi malware
python3 << 'PYEOF'
# Simulasi PE file (Windows executable pattern)
import struct

pe_data = bytearray()
# DOS Header
pe_data += b'MZ'  # Magic
pe_data += b'\x00' * 58
pe_data += struct.pack('<I', 0x80)  # e_lfanew → PE offset

# PE Signature
pe_data += b'PE\x00\x00'

# File Header (COFF)
pe_data += struct.pack('<HHIIIIIHHHHHH',
    0x14C,    # Machine: x86
    3,        # NumberOfSections
    0,        # TimeDateStamp
    0, 0, 0,  # PointerToSymbolTable, NumberOfSymbols
    0xE0,     # SizeOfOptionalHeader
    0x103     # Characteristics: EXECUTABLE_IMAGE + 32BIT
)

# Optional Header (partial)
pe_data += struct.pack('<HBBIIIIIHHIIHHIIIIIIHHHHHHIIIIIIIIII',
    0x10B,    # Magic: PE32
    0x10,     # MajorLinkerVersion
    0,        # MinorLinkerVersion
    0x1000,   # SizeOfCode
    0x2000,   # SizeOfInitializedData
    0,        # SizeOfUninitializedData
    0x1000,   # AddressOfEntryPoint  ← ENTRY POINT!
    0x1000,   # BaseOfCode
    0x400000, # ImageBase
    0x1000,   # SectionAlignment
    0x200,    # FileAlignment
    4, 0,     # MajorSubsystemVersion, Minor
    0,        # Win32VersionValue
    0x4000,   # SizeOfImage
    0x1000,   # SizeOfHeaders
    0, 0, 0, 0,  # CheckSum, Subsystem, DllCharacteristics
    0x100000, 0x1000, 0x200000, 0x2000,  # Stack/Heap reserves
    0, 0, 0, 0, 0, 0  # LoaderFlags, NumberOfRvaAndSizes
)

# Section table
for name, vaddr, vsize, raw, rsize, chars in [
    (b'.text\x00\x00\x00', 0x1000, 0x200, 0x200, 0x200, 0x60000020),
    (b'.data\x00\x00\x00', 0x2000, 0x100, 0x400, 0x100, 0xC0000040),
    (b'.rsrc\x00\x00\x00', 0x3000, 0x100, 0x500, 0x100, 0x40000040),
]:
    pe_data += name + struct.pack('<IIIIIIHH',
        vsize, vaddr, rsize, raw, 0, 0, 0, chars)

# Code section (.text) - simulated malicious code
code = b'\x68\x00\x00\x00\x00'  # PUSH 0
code += b'\x68\x00\x00\x00\x00'  # PUSH 0
code += b'\xE8\x00\x00\x00\x00'  # CALL (probably WinExec)
code += b'\x6A\x00'              # PUSH 0
code += b'\xE8\x00\x00\x00\x00'  # CALL (probably ExitProcess)
pe_data += code

# Append hidden strings (not in proper section - data appended)
pe_data += b'\x00' * 100
pe_data += b'http://malware-c2.com/payload.exe\x00'
pe_data += b'cmd.exe /c whoami\x00'  
pe_data += b'C:\\Windows\\System32\\rundll32.exe\x00'
pe_data += b'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\x00'
# XOR-encoded strings  
pe_data += bytes([c ^ 0x55 for c in b'Password=SuperSecret'])

with open('sample-malware.exe', 'wb') as f:
    f.write(pe_data)

print("✅ sample-malware.exe created (simulasi PE file)")
PYEOF

# 2. File identification
echo "=== file Command ==="
file sample-malware.exe

# 3. Hashing
echo ""
echo "=== SHA256 Hash ==="
sha256sum sample-malware.exe

# 4. Strings analysis
echo ""
echo "=== Strings (min 8 chars) ==="
strings -n 8 sample-malware.exe

# 5. Suspicious strings filtered
echo ""
echo "=== ⚠️ Suspicious Indicators ==="
strings sample-malware.exe | grep -iE "(http|https|cmd|powershell|rundll|WinExec|CreateProcess|socket|connect|download|upload)"

# 6. XOR decode
echo ""
echo "=== XOR Decode (key=0x55) ==="
python3 -c "
data = open('sample-malware.exe', 'rb').read()
# Find XOR-encoded data (bytes that become readable when XOR'd with 0x55)
decoded = bytes([b ^ 0x55 for b in data])
# Extract readable strings
import re
for m in re.finditer(b'[A-Za-z0-9_@.\\-]{8,}', decoded):
    print(f'  {m.group().decode()}')
"