2

a virus code (x bytes long) is XORed with a x bytes long word (we call this T). This word T is built repeating multiple times a 8 byte secret key.

the infected file contains this XORed (obfuscated) virus code, the 8 bytes secret key, and a loader. We don't know the location of those 3 entities inside the file. The loader, when executed, uses the secret key to build T and extract the virus code.

If I have the original virus code (but not the loader nor the secret key), how do I determine if a file is infected?

Improve this question

2 Answers 2

Reset to default
3

You can't. You'll need to detect the loader, and either mark all files containing the loader as virus, or detect where T and the encrypted area is and decrypt the encrypted area to check whether the encrypted area contains the virus you are looking for.

Improve this answer
2
  • so having the original virus code is useless? if you detect the loader (but how?), then how do you detect T, giving the fact the the secret key is different for each instance of the virus?
    – user77326
    May 26, 2015 at 12:16
  • 1
    @RonnieDrew: the loader will need T to decrypt the real payload, so the loader necessarily contain all the logic needed for it to retrieve T. This is most likely either encoded in the loader itself or the loader may fetch T from the network. Either way, you'll be able to decrypt the payload and check whether it's the virus you're looking for.
    – Lie Ryan
    May 26, 2015 at 12:24
2

There are a few possibilities.

First, if the loader can be discovered by a virus scanner. For this, it is necessary for the virus scanner to recognize the loader as a piece of known malware.

Second, if there is a system in place to discover tampering with files, you might discover that the infected file was modified.

Finally, if for some reason you are certain that this particular attack is going on, you could go to every suspected file, grab every sequence of 8 bytes in the file, and XOR them with every sequence of 8 bytes in the file until you find the actual virus code.
If you don't know T, you'd first try T=1, then try for T=2, and so on.
The process has a quadratic time complexity. The virus writer can cause it to have factorial complexity by distributing the parts of the key over the file, not putting them in sequence.

Improve this answer
5
  • so having the original virus code would only help to know its lenght? since I know its lenght, I should only search T = virus_length..divide it by 8 and find such pattern inside the file?
    – user77326
    May 26, 2015 at 12:25
  • It helps to know the length, and to verify that you found the virus.
    – S.L. Barth is on codidact.com
    May 26, 2015 at 12:34
  • thank you. Which technique should I use to discover the loader? (this is a theorical excersise, I know that in real life a virus scanner could do it). I can't detect files tampering.
    – user77326
    May 26, 2015 at 12:48
  • @RonnieDrew: antivirus would typically detect the loader's "signature". In the common case, the "virus signature" could be a sequence of string that the virus/loader always contains, which can detected by simple substring matching or regular expression. Sometimes the "signature" is more complex, and the antivirus researchers had to write code specifically to detect that family of loader.
    – Lie Ryan
    May 26, 2015 at 13:09
  • 1
    @RonnieDrew: Some advanced "signatures" could be based on behavioral/heuristics, for example the antivirus may hook into the system to detect programs that try to make a network connection to a known command and control center or that tries to modify a specific system file in a certain way. In this respect, there's no difference between detecting virus and detecting loaders.
    – Lie Ryan
    May 26, 2015 at 13:12

You must log in to answer this question.