Vol.55 No (May 2014) MS 1,a) 2,b) , MS Rich Text Compound File Binary MS MS MS 98.5% MS Rich Text CFB MS Methods to D

Size: px

Start display at page:

Download "Vol.55 No (May 2014) MS 1,a) 2,b) , MS Rich Text Compound File Binary MS MS MS 98.5% MS Rich Text CFB MS Methods to D"

せいこやぎ
4 years ago
Views:

1 MS 1,a) 2,b) , MS Rich Text Compound File Binary MS MS MS 98.5% MS Rich Text CFB MS Methods to Detect Malicious MS Document File Using File Structure Inspection Yuhei Otsubo 1,a) Mamoru Mimura 2,b) Hidehiko Tanaka 2 Received: September 13, 2013, Accepted: February 14, 2014 Abstract: Today, the number of targeted attacks is increasing, and targeted attacks are becoming a serious threat for many organizations. There are various kinds of targeted attacks. Above all, a method to attach malware to interesting for the recipient is the most popular. In general, there is no way to distinguish a malicious document file from a normal one, because an executable file is embedded in a document file to hide oneself during an attack. We analyzed malicious MS document (Rich Text or Compound File Binary) files containing an executable file. Then, we found that there are differences in file structure between normal MS document files and malicious ones. In this paper, we propose detection methods of malicious MS document files using file structure inspection. The experimental result shows the effectiveness of the methods. The methods could detect 98.5% of the malicious MS document files in the experiment. The methods are effective in the detection of malicious Rich Text files and malicious CFB files over a long time. Because the attacker is almost not able to alter a file structure. Keywords: targeted attack, malware, MS document file, static analysis, detection 1. 1 NPA, Chiyoda, Tokyo , Japan 2 IISEC, Yokohama, Kanagawa , Japan a) mjp11001@grips.ac.jp b) dgs104101@iisec.ac.jp % % [1] c 2014 Information Processing Society of Japan 1530

2 & exploit shellcode shellcode exe dll Microsoft Rich Text [2] rtf doc CFB Compound File Binary [3] doc xls ppt jtd jtdc MS MS MS MS MS MS MS MS MS 2. MS MS exploit MS [4] [5] exploit MS [6] Handy Scissors [7] MS OfficeMalScanner [8] MS MS [9] MS MS MS 4 4 c 2014 Information Processing Society of Japan 1531

3 1 MS CFB MS MS MS MS MS Microsoft Microsoft Office 2010 Office [10] Office xls doc ppt pub Office Office 3. MS exploit [2] [3] Fig. 1 {\rtf Hello,\par {\b world}!\par } 1 Rich Text An example of a Rich Text format file. NULL shellcode shellcode MS MS 3.1 Rich Text Rich Text Microsoft 1 Rich Text 7bit ASCII Rich Text 1 { Rich Text { } EOF } EOF EOF Rich Text } EOF Rich Text EOF 3.2 CFB CFB Microsoft 1 Microsoft Word Microsoft c 2014 Information Processing Society of Japan 1532

4 2 CFB Fig. 2 CFB hierarchy. DE a.txt Stream sector index sector sector FAT sector index sector FAT DE CFB sector sector 0 Size file sector Size sector (Size file 512) mod Size sector =0 (1) 3 CFB Fig. 3 CFB structure. Excel Microsoft PowerPoint doc xls ppt CFB 1 JustSystems jtd jtdc CFB CFB 2 CFB Stream Storage CFB 3 CFB 512 Byte sector index Stream sector Stream sector Stream sector sector FAT File Allocation Table 3 n sector sector FAT n 4Byte sector -2 sector Free Sector sector -1 Stream Storage DE Directory Entry FAT DE sector index CFB a.txt Stream 3 FAT DE sector DE a.txt CFB CFB sector (1) FAT FAT sector1 4Byte FAT sector1 Size sector 4 sector FAT sector Count FAT FAT Size FAT Size FAT =Count FAT Size sector 4 (2) CFB sector FAT FAT Size file 512 Size FAT (3) CFB FAT (3) Free Sector [9] 1 Free Sector CFB Free Sector Free Sector CFB sector Free Sector Free Sector MS Free Sector c 2014 Information Processing Society of Japan 1533

5 CFB sector Free Sector sector CFB sector DIFAT Double-Indirect FAT FAT minifat DE Stream Free Sector 6 DIFAT FAT sector minifat Stream CFB 6 sector 4. 5 Python MS Rich Text CFB Rich Text 1 MS CFB 2 5 MS Byte EOF } CFB 30 Byte sector 2Byte SectorShift sector Size sector 2 SectorShift (1) CFB 44 Byte FAT sector 4Byte Count FAT (2) Size FAT (3) CFB sector index n CFB 512 Byte n +1 sector Size file Size file = (n +1) Size sector (4) n n FAT -1 Free Sector sector sector 1 CFB FAT sector sector sector sector 5 sector Count real sector Count real =(Size file 512) Size sector (5) 4 Fig. 4 The algorithm of the test program. FAT sector Count FAT CFB 44 Byte 4Byte minifat sector Count minifat CFB 64 Byte 4Byte DIFAT sector Count DIFAT CFB 72 Byte 4Byte DE Stream sector index CFB 48 Byte 4Byte index FAT DE sector Count DE c 2014 Information Processing Society of Japan 1534

6 Stream sector Count Stream DE DE Byte 120 Byte Stream 4Byte Stream Stream Root Entry Stream Root Entry Stream CFB 56 Byte 4Byte Size mini DE n Stream Size n Stream sector Count n Size n Size mini Stream Root Entry Count n 0 Size n Size mini Size n sector Count n { 0 (Sizen < Size mini ) Count n = Size n Size sector (Size n Size mini ) (6) Stream sector Count Stream Stream sector Free Sector Count free FAT -1 sector sector Count theoretical Count FAT Count minifat Count DIFAT Count DE Count Stream Count free CFB sector sector MS MS MS 1 1 MS 1 Table 1 A summary of the specimens. MS MS KB KB rtf doc , xls jtd/jtdc , RAT doc Rich Text rtf Windows MS12-027:CVE Microsoft Office MS10-087:CVE Adobe Flash Player APSB12-18:CVE [11] OfficeMalScanner Office 1 contagio clean [12] html MS Table 2 Vulnerabilities used by the specimens of rtf MS / % MS / % doc MS / % APSB / % APSB / % APSB / % APSB / % - 1 / % xls MS / % MS / % MS / % APSB / % APSB / % - 1 / % jtd/jtdc c 2014 Information Processing Society of Japan 1535

7 3 Table 3 An experimental environment. CPU Core i GHz Memory 8.0 GB OS Windows 7 SP1 Memory VM 2.0 GB OS VM Windows XP SP3 Interpreter VM Python Table 4 Detection rates of the test program. rtf 97 / % s doc 35 / % s xls 48 / % s jtd/jtdc 17 / % s 197 / % s 5 Table 5 Detection rates of the features / % 2 79 / % 3 92 / % 4 99 / % 5 98 / % % s s rtf 2 5 doc xls jtd/jtdc OfficeMalScanner % 21.0% 3 1 T S M AV 43.0% 6 Table 6 Comparing detection rates with antivirus softwares, etc / % T AV 42 / % S AV 40 / % M AV 42 / % T S M AV 86 / % OfficeMalScanner 182 / % Office 33 / % 7 Table 7 False positive rate of the test program. rtf 0 / % doc 2 / 1, % xls 14 / % 16 / 1, % OfficeMalScanner v0.58 CFB shellcode SCAN BRUTE Rich Text Office- MalScanner RTFScan SCAN OfficeMalScanner OfficeMalScanner RTFScan OfficeMalScanner 91.0% Office Microsoft Office 2007 KB MS KB KB MS Office KB doc xls Office Office Office 38.8% Office 1, % xls 4.7% c 2014 Information Processing Society of Japan 1536

8 8 Table 8 A summary of the specimens not detected by the test program. rtf MS shellcode doc APSB12-18 flash xls - VBA 2012 exploit shellcode exploit shellcode exploit shellcode exploit shellcode exploit shellcode 3 OfficeMalScanner rtf xls 2 Handy Scissors rtf 1 doc html html 4KByte html 10 1 MS html MS MS sector 2 sector sector 5 MS MS MS 1 contagio zip zip CRC contagio zip contagio 6.3 Office Office 38.8% 98.5% Office 2 Office 2 Office 2 5 Office s 98.5% MS 0.9% c 2014 Information Processing Society of Japan 1537

9 Table 9 Rate of extension of files that were used to attack in doc rtf 37.0% 17.0% xls 8.0% 8.5% jtd 1.0% 0.0% pdf 19.0% 2.5% exe 30.0% 61.0% etc 5.0% 11.0% [13] MS doc rtf xls jtd rtf doc xls jtd/jtdc 2012 MS MS zip zip MS 2 OfficeMalScanner Handy Scissors MS MS exploit MS Office 38.8% 98.5% MS MS jtd/jtdc doc rtf exploit shellcode exploit shellcode exploit shellcode 7. MS 5 MS s 98.5% Rich Text CFB MS MS 3 MS 5 1 MS Stream Stream c 2014 Information Processing Society of Japan 1538

MS OOXML Office Open XML [14] docx xlsx pptx MS OOXML MS ZIP OOXML Office OOXML MS OOXML MS OOXML MS OOXML MS OOXML MS 2012 OOXML MS OOXML MS [1] (online) http://www.meti.go.

aspx?id=10725 (accessed 2013-05-22). [3] Microsoft: [MS-CFB]: Compound File Binary File Format (online), available from http://msdn.microsoft. com/en-us/library/dd942138.aspx (accessed 2013-05- 22).

10 MS OOXML Office Open XML [14] docx xlsx pptx MS OOXML MS ZIP OOXML Office OOXML MS OOXML MS OOXML MS OOXML MS OOXML MS 2012 OOXML MS OOXML MS [1] (online) press/2011/05/ / html [2] Microsoft: Rich Text Format (RTF) Specification, version (online), available from microsoft.com/en-us/download/details.aspx?id=10725 (accessed ). [3] Microsoft: [MS-CFB]: Compound File Binary File Format (online), available from com/en-us/library/dd aspx (accessed ). [4] Stolfo, S.J., Wang, K. and Li, W.J.: Towards Stealthy Malware Detection, Advances in Information Security, Vol.27, pp (2007). [5] Li, W.J., Stolfo, S.J., Stavrou, A., Androulaki, E. and Keromytis, A.D.: A Study of Malcode-Bearing Documents, Detection of Intrusions and Malware and Vulnerability Assessment (DIMVA), Vol.4 of Lecture Notes in Computer Science, pp (2007). [6] Handy Scissors Vol.54, No.3, pp (2013). [7] RAT Vol.55, No.2, pp (2014). [8] Boldewin, F.: Analyzing MSOffice malware with OfficeMalScanner (online), available from reconstructer.org/papers/analyzing%20msoffice %20malware%20with%20OfficeMalScanner.zip (accessed ). [9] Hyukdon, K., Yeog, K., Sangjin, L. and Jongin, L.: A Tool for the Detection of Hidden Data in Microsoft Compound Document File Format, ICISS 08, Proc International Conference on Information Science and Security, pp (2008). [10] Microsoft: Microsoft Office Microsoft Office (online) microsoft.com/ja-jp/security/advisory/ [11] 2012 Tokyo SOC IBM - Japan (2013). [12] Mila, P.: 16,800 clean and 11,960 malicious files for signature testing and research (online), available from clean-and malicious-files.html (accessed ). [13] 2012 A Trend Micro White Paper (2013). [14] ISO/IEC 29500: 2012: Information technology Document description and processing languages Office Open XML File Formats (2012) c 2014 Information Processing Society of Japan 1539

1970 2004 2012 Parallel Inference Engine IEEE c

11 Parallel Inference Engine IEEE c 2014 Information Processing Society of Japan 1540

& Vol.5 No (Oct. 2015) TV 1,2,a) , Augmented TV TV AR Augmented Reality 3DCG TV Estimation of TV Screen Position and Ro

& Vol.5 No (Oct. 2015) TV 1,2,a) , Augmented TV TV AR Augmented Reality 3DCG TV Estimation of TV Screen Position and Ro TV 1,2,a) 1 2 2015 1 26, 2015 5 21 Augmented TV TV AR Augmented Reality 3DCG TV Estimation of TV Screen Position and Rotation Using Mobile Device Hiroyuki Kawakita 1,2,a) Toshio Nakagawa 1 Makoto Sato