Malware Analysis

Why It Matters

Modern threats deliver custom-built or rapidly-evolving malware faster than vendors can issue signatures. When endpoints flag a suspicious binary or incident response teams find an unknown executable on a compromised host, malware analysis converts a single sample into the IOCs, behavioral patterns, and detections that protect the rest of the environment.

The 2017 NotPetya analysis revealed it was a destructive wiper, not ransomware, redirecting global response. Reverse engineering of Stuxnet exposed nation-state capability. Analysis of the SolarWinds SUNBURST backdoor produced detections used worldwide.

The Analysis Workflow

1. Triage

Quick wins before deep analysis:

• Hash lookup on VirusTotal, MalwareBazaar, Hybrid Analysis
• File type and architecture identification
• Strings and entropy to detect packing
• AV/EDR signature matches

2. Static Analysis

Examining the binary without execution:

# Common static analysis commands
file suspicious.exe                # File type
strings -n 8 suspicious.exe        # Printable strings
sha256sum suspicious.exe           # Hash
exiftool suspicious.exe            # Metadata
pefile / pe-bear / CFF Explorer    # PE structure
yara rules.yar suspicious.exe      # YARA matching
capa suspicious.exe                # Capability detection

Look for imports (suspicious WinAPI calls like VirtualAllocEx, WriteProcessMemory, CreateRemoteThread), embedded resources, and indicators of packing (high entropy, few imports, unusual section names).

3. Dynamic Analysis

Run the sample in an isolated environment and observe:

• Process tree changes
• File system writes (autostart locations, dropped payloads)
• Registry modifications (persistence keys)
• Network behavior (DNS, C2 beaconing, exfiltration)
• Mutex creation and named pipes

Sandboxes automate much of this: Cuckoo, Any.run, Joe Sandbox, Hybrid Analysis.

4. Code-Level Analysis

For sophisticated samples, reverse engineer with disassemblers and decompilers:

• IDA Pro: industry standard with decompiler add-on
• Ghidra: free NSA-developed alternative with strong decompilation
• Binary Ninja: modern UI with scripting
• x64dbg / WinDbg: dynamic debugging

Manual analysis recovers algorithms (encryption schemes, custom protocols), evasion techniques (anti-debug, anti-VM), and unique fingerprints suitable for high-fidelity detections.

Anti-Analysis Techniques

Outputs

Malware analysis produces tangible defensive products:

Frameworks and Standards

• MITRE ATT&CK: standard taxonomy of TTPs
• MAEC: Malware Attribute Enumeration and Characterization
• STIX/TAXII: structured threat information sharing
• YARA: rule language for pattern-matching
• Capa: identifies capabilities in executables

Best Practices

1. Always work in isolated VMs with reliable snapshot/revert.
2. Maintain analysis-only network segments with simulated internet.
3. Hash and document everything for chain of custody.
4. Time-box deep analysis, most samples do not warrant week-long reversing.
5. Share findings with the community via MISP, MalwareBazaar, or industry ISACs.
6. Map findings to ATT&CK for consistent intelligence integration.

Related Concepts

• Malware
• Threat Hunting
• Threat Intelligence
• Incident Response