[Hands-on] Find the Heart of Malware! 🫀 Locating Encryption/Network Functions and Detailed Code Analysis

Hello, persistent security researchers! 🕵️‍♂️

Last time, we identified “what tools” malware brought using metadata (IAT, strings). “Hmm, it brought encryption tools (CryptEncrypt) and communication tools (InternetOpen). Looks like ransomware!”

But that’s not enough. Just because a culprit bought a knife doesn’t necessarily mean they committed a crime. We need to raid the scene to find out “when, where, and how they wielded that knife.”

Today, we will conduct a hands-on practice using reverse engineering tools (Ghidra or IDA) to locate and analyze the core logic (heart) of the code where malicious acts actually occur.

Mastering this technique will allow you to navigate to the core logic with just 3 clicks, without getting lost in tens of thousands of lines of code! 🚀

---

1. 🧭 Prepare Your Compass: The Magic of Cross-Reference

Trying to find an encryption function hidden among tens of thousands of lines of assembly code by eye would take all night and still not be enough. The cheat code for this is Cross-Reference (X-Ref).

💡 What is Cross-Reference? It’s a function that asks, “Who called this function (API)?” It’s just like the ‘Index’ at the back of a book. When you look up a word, it tells you the page numbers where that word is used.

---

2. [Hands-on 1] Locating Encryption Logic (Ransomware Core) 🔐

The essence of ransomware is ‘file encryption’. Let’s catch it in the act.

🛠️ Tools: Ghidra (Free) or IDA Pro 📂 Target API: CryptEncrypt (or WriteFile)

👣 Step-by-Step Tracking

1. Open Symbol Tree: In Ghidra’s Symbol Tree window on the right, open the Imports folder.
2. Search API: Find CryptEncrypt within ADVAPI32.DLL.
3. Check X-Ref:
• Right-click on the CryptEncrypt function name -> Show References to (or shortcut Ctrl+Shift+F).
1. Raid the Scene (Jump): Double-click on the address that appears in the list (e.g., FUN_00401000).

🎯 Arrived! The screen will move to the exact location where the file encryption loop is running. Around it, you’ll see code performing XOR operations or loading file content into a buffer.

---

3. [Hands-on 2] Locating Network Connection (C2 Communication) 🌐

Let’s find the communication section where information is exfiltrated to hackers or keys are received.

📂 Target API: InternetOpenUrl, HttpSendRequest, socket, connect

👣 Step-by-Step Tracking

1. Search by Strings: This time, let’s search by strings instead of APIs.
• Click Search -> Strings in the top menu.
• Search for http, https, or suspicious IP addresses.
1. Check X-Ref:
• Right-click on the found URL string (e.g., ) -> Show References to.
1. Raid the Scene: Navigate to the function that uses that string.

🎯 Arrived! Analyzing this location will tell you exactly “what data is being sent, by what method (GET/POST), and where.”

---

4. 🧠 [Advanced] Code Area Analysis with AI

You’ve found the function’s location, but the code looks like gibberish (uVar1, param_2…) right? This is where you can utilize AI’s capabilities 200%, as we learned last time.

📝 Decompiled Code Analysis Prompt

Copy the C code from Ghidra’s Decompile window and ask AI this:

[Request] The C code below is a function that calls the CryptEncrypt API. It was extracted with a reverse engineering tool, so the variable names are messy.

>

1. Please explain the working principle of this function step-by-step.

2. Please infer what roles variables like local_14, param_1 actually play (file handle, buffer, key, etc.).

3. Please convert this code into easy-to-understand Python pseudocode.

>

[Code] (Paste code copied from Ghidra)

AI will read the context and clearly interpret, “local_14 is a file handle, and it’s encrypting files by reading 1024 bytes in a loop!”

---

5. ⚠️ Points to Note During Analysis (Avoiding Traps)

1. Dynamic Loading:
• Smart malware hides APIs in the Imports list.
• Instead, it uses LoadLibrary and GetProcAddress to load APIs during runtime.
• If the API you’re looking for isn’t in Imports, you’ll need to trace GetProcAddress.
1. Wrapper Function:
• Malware developers often create a function like MyEncrypt and call CryptEncrypt within it.
• If you follow an X-Ref and the code is too short, you need to go one step further up to the calling function (Caller) to see the full picture.

---

🎉 Conclusion: See the Forest, Then Cut the Trees!

Today, we learned how to accurately find where the ‘malicious act’ tree is planted in the vast forest of code.

• Cross-Reference (X-Ref) is your map.
• Decompiler (Ghidra) is your translator.
• AI is your guide.

By combining these three, you can dissect the core logic of even the most complex malware.

Now, you are an expert who can say, beyond “This file is malicious,” that “The function at address 0x401000 inside this file encrypts files with AES-256.”

Next time, we will conclude with the grand finale of compiling all our analysis into a “Practical Malware Analysis Report.” Stay tuned! 👋

---