Hello, security researchers! π΅οΈββοΈ
When we judge a person, we don’t just judge them by their ‘appearance’, do we? We need to look at ‘what actions’ they usually take to truly understand their character.
The same applies to software (files).
Even if their outward appearance (icon, filename) can be disguised as something like a Calculator, the internal actions of requesting the operating system (OS) through API (Application Programming Interface) calls are difficult to deceive.
- Normal File (Calculator): “Draw numbers on the screen”, “Receive mouse clicks”
- Malicious File (Ransomware): “Fetch all file lists”, “Encrypt them”, “Connect to the internet and send keys”
Today, we will practice extracting the API call list (Import Table) of normal and malicious files and then asking AI, “Guess who the culprit is!”
Can AI really detect malware just by looking at this ‘list of actions’? Let’s find out! π
1. What is an API Call List (Import Table)? π
Windows executable files (PE) don’t do everything by themselves. To read files or access the internet, they need to ask the Windows operating system for “help!”. The functions used for this are Windows API.
The list where a file declares, “I need these functions when I run!” is called the IAT (Import Address Table), and just by looking at this, you can guess 80% of the file’s purpose.
2. [Preparation] Extracting API List π οΈ
There are various extraction methods (PEStudio, Ghidra, etc.), but we will use the fastest and simplest Python script. (pefile library required)
π‘ Tip: If you don’t have Python, you can put the file into a free tool like ‘PEStudio’ and scrape the ‘Imports’ tab!
π Python Extraction Script (extract_api.py)
Python
import pefile
def get_api_list(file_path):
try:
pe = pefile.PE(file_path)
print(f"--- [ {file_path} ] API List ---")
for entry in pe.DIRECTORY_ENTRY_IMPORT:
for imp in entry.imports:
if imp.name:
print(imp.name.decode('utf-8'))
except Exception as e:
print(f"Error: {e}")
# Practice: Specify paths for normal files (calculator) and malicious samples
get_api_list("C:\Windows\System32\calc.exe")
get_api_list("malware_sample.exe")3. [Data] Comparing Extracted API Lists (Sample Data) π
Here are the API lists of two files obtained by running the script. Can’t you tell they feel different just by glancing at them?
β File A (Normal File: Calculator)
GetMessageW
TranslateMessage
DispatchMessageW
SetWindowTextW
DrawTextW
BeginPaint
EndPaint
LoadIconW
...π Features: Paint, Window, Message… Functions primarily for drawing on the screen and interacting with the user (GUI) are visible.
β File B (Malicious File: Suspected Ransomware)
FindFirstFileA
FindNextFileA
CryptAcquireContextA
CryptGenKey
CryptEncrypt
InternetOpenA
InternetConnectA
HttpSendRequestA
WriteFile
Process32First
VirtualAllocEx
...π Features: FindFile (searching files), Crypt (encryption), Internet (network), VirtualAlloc (memory allocation)… It seems to be performing some covert and aggressive operations.
4. [Practice] Asking AI, “Who’s the culprit?” π£οΈ
Now, let’s copy this list as is and let AI (ChatGPT, Claude, etc.) make the judgment.
π Prompt
[Role] You are a malware analysis expert.
>
[Situation] I have API Import lists extracted from two executable files (A, B).
>
[Request]
>
1. Analyze the API list of each file and infer the program’s main functions (behaviors).
2. Identify the file suspected of being malware among the two and explain the threatening API combinations that serve as evidence.
3. Classify the expected type of malicious behavior (e.g., ransomware, keylogger, injector, etc.).
>
[Data]
>
(File A list):
>
GetMessageW, TranslateMessage, SetWindowTextW, DrawTextW, … (Paste the normal list above)
>
(File B list):
>
FindFirstFileA, CryptEncrypt, InternetOpenA, VirtualAllocEx, … (Paste the malicious list above)
5. [Result] AI’s Chilling Analysis π΅οΈββοΈ
AI reads the ‘context’ from a mere list of function names.
π€ AI Analysis Result
>
1. Behavior Analysis:
>
– File A: A typical GUI application that creates a Windows window, draws text on the screen, and waits for user input. No dangerous functions are observed.
– File B: Explores the file system (FindFile), encrypts data (CryptEncrypt), communicates with external servers (HttpSendRequest). Also shows signs of attempting to access memory of other processes (VirtualAllocEx).
>
2. Culprit Identified: π¨ File B (Suspected Malicious)
>
3. Decisive Evidence (Suspicious API Combination):
>
– Ransomware Indication: The combination of FindFirstFile + WriteFile + CryptEncrypt is a typical ransomware pattern that finds files on the PC, encrypts their content, and overwrites them.
– C2 Communication: InternetOpen + HttpSendRequest are network actions for sending encryption keys or receiving commands.
– Injection: VirtualAllocEx is frequently used to inject malicious code into other processes.
>
4. Conclusion:
>
File B is highly likely to be Ransomware or an information-stealing Trojan. Isolate it immediately!
6. Conclusion: AI, an Excellent Partner for Static Analysis π€
What do you think? We didn’t look at a single line of code; we just showed a list of “what tools (APIs) it brought along,” and AI accurately determined whether it was malicious.
Of course, sophisticated malware can hide APIs (Dynamic Loading), but this ‘API profiling’ technique is one of the fastest and most effective methods for initial analysis.
If you have a suspicious file on your PC, try extracting its API list using the method learned today and ask AI! It might tell you an unexpected result. π»
Next time, in the theory section, we will prepare to delve into the real code, not just the appearance, through “Assembly Instruction Patterns and C Language Mapping Structure.” Stay tuned!
Leave a Reply