Malware analysis fundamentals

Work safely first

• Use an isolated analysis environment: a virtual machine with snapshots, no shared folders, no connection to your corporate network, and a host-only or simulated internet.
• Never analyze on your everyday machine or a system that holds credentials.
• Treat every sample as live. Rename it so it cannot be run by accident, and store it in an encrypted archive.
• Do not upload a sensitive sample to a public service if it may contain your company's data; check a hash first.
• Have authority and a reason to analyze it, and follow your organization's rules on handling malware.

Triage and static analysis

file sample.bin                              # what type of file is it?
sha256sum sample.bin                         # identity: look this hash up before anything else
strings -n 8 sample.bin | less               # readable strings: URLs, paths, commands, error messages
strings -el -n 8 sample.bin | less           # UTF-16 strings (common in Windows binaries)
# for Windows executables, review imports and sections with a PE tool (pefile, DIE)
# suspicious signs: packed sections with high entropy, few imports, imports for process injection

Dynamic analysis

• Run the sample in the isolated lab with monitoring: process creation, file and registry changes, network traffic and persistence mechanisms.
• A sandbox (CAPE, ANY.RUN or an internal one) automates this and produces a behavior report; read it critically, since samples may detect sandboxes and stay quiet.
• Simulate the internet (FakeNet-NG, INetSim) to see the traffic the sample tries to make without letting it reach the real one.
• Snapshot before running and revert after, every time.
• Disassemblers and decompilers (Ghidra, IDA) are the next step when behavior alone does not answer the question.

From analysis to defense

rule Example_Process_Injector
{
  meta:
    description = "Windows executable importing classic process injection APIs"
    author      = "analyst"
    reference   = "INC-2026-0142"
  strings:
    $mz = { 4D 5A }
    $a1 = "VirtualAllocEx" ascii
    $a2 = "WriteProcessMemory" ascii
    $a3 = "CreateRemoteThread" ascii
  condition:
    $mz at 0 and all of ($a*)
}

What to report

• Identity: hashes, file type, size, first-seen date and any known family name.
• Behavior: what it does on the system, how it persists, what it contacts, what it steals or changes.
• Indicators: network, file and registry artifacts, with a confidence level and an expiry.
• Detections: YARA or Sigma rules, and how they were tested for false positives.
• Remediation: how to find affected systems and how to remove the infection and the persistence safely.