Windows programs

livewells reads a Windows program as data. It lists what the file holds and flags the parts that attackers use. The program never runs.

Send a program

Send a .exe, .dll, .sys, .scr, .cpl, .ocx or .com file on the Upload a file tab, or through the API. livewells decides the type from the content of the file, so a program with another name gets the same reading. livewells also reads a program inside another item of the same case, such as an email attachment or an archive member.

A program always carries the flag "This file type can start a program when it opens. Do not open it." Your analysts set the verdict.

What you see

• Facts. Kind (program, library or driver), machine, 32-bit or 64-bit, subsystem, compile time as the file states it, number of sections, imported functions, exported functions, import hash, digital signature and installer framework.
• Version information. Company, description, file version, product, original name, internal name and copyright, as the file states them.
• Sections. The name, the size in memory, the size in the file and the entropy of each section, and whether the section can run or change.
• Imports of concern. The functions that raised an import flag, grouped by what they allow.
• Libraries imported and exported names. The name of each library the program imports, and each name a library exports.
• Programs inside the resources. The size and SHA-256 of each program that sits in the resources of the file. livewells checks each one as its own item.
• Web addresses and hosts. Each web address, host name and IP address in the text of the file. Each is defanged.

Every address and host name in the report is defanged. An example is hxxps[://]example[.]com/a.

Signatures

livewells reads the digital signature in the file as data, and the report gives the signer, the issuer, the dates and whether the digest in the signature matches the file.

• For a signature that livewells read, the report says present, not validated to a root certificate.
• A digest that differs from the file raises a flag, and so does a signature that cannot be read.
• The import hash is the MD5 of the lower-case library and function names in import order.

Installers

livewells names the installer framework (NSIS, Inno Setup, 7-Zip SFX, WiX Burn or an MSI wrapper) when it reads that framework's own structure in the file, and then a program in the resources, data after the end and a small import table are reported under one installer flag instead of three.

A start marker that is not followed by the structure of an installer names no framework and raises its own flag. For that file, and for an installer whose signature digest differs from the file or whose signature cannot be read, the program in the resources, the data after the end and the small import table keep their own flags.

How livewells decides

• A section counts as packed when its entropy is 7.2 or more and it holds at least 1,024 bytes, or when its name is one that packers use. The resource section is not judged by entropy.
• A program has a small import table when it imports fewer than 5 functions and is not built for .NET.
• A program has extra data after its end when more than 256 bytes follow the last section, not counting the digital signature.
• The checksum flag appears when the stored checksum is not zero and differs from the computed one.
• An import group raises its flag when the program imports at least 2 functions of the group. The group for fetching files and starting programs needs one function of each kind.

Limits

When a program reaches a limit, livewells reads what it can and raises the flag "We stopped reading part of this program because it is too big or too deep." Treat that program as hostile.

Flags

A flag points at something to check. Your analysts set the verdict.