We have released a new version of Wepawet: 2.3.1.
The main change with this version is the integration of shellzer, a new dynamic shellcode analyzer. Shellzer analyzes the shellcode identified by Wepawet: in particular, it generates a complete list of the API functions called by the shellcode, and it identifies the URLs fetched at run-time by the shellcode (locating additional malware samples).
Here is an example of the output produced by shellzer:
Notice that the standard shellcode section of the report is extended with a detailed “Shellcode Analysis” report, which contains:
- the trace of the API functions (and their parameters) invoked by the shellcode,
- the list of the DLLs loaded by the shellcode, and
- the list of the URLs contacted by the shellcode.
From the report, it is clear that the shellcode in the example above performs the classic download-and-execute steps: it loads the urlmon library, uses its URLDownloadToFileA function to download a file to the temporary directory (as determined using the GetTempPathA function), and then executes this file via WinExec.
If you are interested in the all the details of shellzer, check out the RAID 2011 paper.
Big kudos to Yanick for developing shellzer, and Alex, for lending a helping hand with the integration and testing!
