Malware Analysis Theory Flashcards
Which teams perform malware analysis?
-
Security Operations
- teams analyze malware to write detections for malicious activity in their networks
-
Incident Response
- analyze malware to determine what damage has been done to an environment to remediate and revert that damage
-
Threat Hunt
- analyze malware to identify IOCs, which they use to hunt for malware in a network
-
Malware Researchers
- in security product vendor teams analyze malware to add detections for them in their security products
-
Threat Research
- teams in OS Vendors like Microsoft and Google analyze malware to discover the vulnerabilities exploited and add more security features to the OS/applications
What are the rules for handling malware in a safe environment?
- Never analyze malware or suspected malware on a machine that does not have the sole purpose of analyzing malware
- When not analyzing or moving malware samples around to different locations, always keep them in password-protected zip/rar or other archives so that we can avoid accidental detonation
- Only extract the malware from this password-protected archive inside the isolated environment, and only when analyzing it.
- Create an isolated VM specifically for malware analysis, which has the capability of being reverted to a clean slate once you are done.
- Ensure that all internet connections are closed or at least monitored.
- Once you are done with malware analysis, revert the VM to its clean slate for the next malware analysis session to avoid residue from a previous malware execution corrupting the next one.
How are executable files often called?
binary or PE (Portable Executable) file
What happens during static malware analysis?
malware is analyzed without being executed
What are some of the examples of static malware analysis tasks?
- hecking for strings in malware
- checking the PE header for information related to different sections
- looking at the code using a disassemble
What happens during dynamic malware analysis?
running the malware in a VM, either in a manual fashion with tools installed to monitor the malware’s activity or in the form of sandboxes that perform this task automatically
What is the Linux distribution built for malware analysis?
Remnux VM
Which command is used to detect the actial file type in Linux?
file
Which Linux command lists down the printable strings present in a file?
strings {filename}
What can the strings command reveal?
embedded text such as URLs, file paths, error messages, Windows API calls or even specific keywords
What can’t be breached when uploading malware sample to a third party malware analyzer?
confidentiality (malware may contain sensitive information specific to a targeted company)
Which Linux command is used to calculate an MD5 checksum?
md5sum
What Linux command is used to find out what’s the access, modify, change and potentially birth time of a file?
stat
What do most PE files use to perform bulk of their jobs?
Windows API
What is entropy?
measure of randomness or unpredictability in a dataset, such as a file or network traffic
What is high entropy usually associated to?
encrypted or compressed data, where the content appears random and lacks obvious patterns or structure
Why is entropy important for malware analysis?
analyzing the entropy of files can help identify potential malware, especially in file formats that are not typically highly randomized, like executable files
Which Linux tool is used for PE file analysis?
pecheck
What is the malware analysis process?
Why is there the extra character . between each character?
beacause each character is 16b long and these specific characters take only 1 byte, so the extra byte is set to 0
