Skip to content
Irregularpedia Logo Irregularpedia

Malware Analysis

Malware Analysis

Section titled “Malware Analysis”

Malware analysis is how defenders answer “what does this thing do, and how do we detect and stop it?” The goal is to produce indicators of compromise (IOCs), detection signatures, and an understanding of capability and intent — not to run hostile code on production systems.

Static analysis

Section titled “Static analysis”

Examine the sample without running it. Fast, safe, and often enough for triage.

  • Identify the file — type and format (PE for Windows, ELF for Linux), architecture, compile timestamp, imports. Tools: file, pecheck, PE-bear, readelf.
  • Strings — pull human-readable strings for URLs, IPs, file paths, registry keys, and commands. Packed samples yield few useful strings (a signal in itself); FLARE’s FLOSS also recovers obfuscated strings.
  • Hashing & reputation — hash the sample (SHA-256) and check threat-intel sources; compute an import hash (imphash) and fuzzy hash (ssdeep) to cluster related samples.
  • YARA — write pattern-matching rules to identify families and hunt for related samples across your estate:
rule suspicious_downloader {
    strings:
        $url = "http://" ascii
        $cmd = "powershell -enc" ascii nocase
    condition:
        uint16(0) == 0x5A4D and all of them   // 0x5A4D = "MZ" (PE header)
}

The Mandiant FLARE toolset (FLOSS, capa, and others) is the standard open-source kit for static work; capa maps a binary’s capabilities to ATT&CK techniques automatically.

Dynamic / behavioral analysis

Section titled “Dynamic / behavioral analysis”

Run the sample in the lab and watch what it does: files created, registry/persistence changes, processes spawned, and network callbacks (C2). Approaches:

  • Automated sandboxes — CAPE (the actively maintained successor to Cuckoo) detonates a sample and produces a behavioral report, including memory dumps and extracted payloads.
  • Manual debugging — step through execution with x64dbg (Windows) or GDB (Linux) to understand logic the sandbox can’t reach (e.g. code behind a trigger).
  • System monitoring — Procmon, Sysmon, and a network sniffer (Wireshark/inetsim) to record behavior and capture C2 indicators.

Behavioral indicators feed directly into Blue Team Tools detections and digital forensics timelines.

Unpacking

Section titled “Unpacking”

Most real-world malware is packed — compressed/encrypted to defeat static analysis and AV. Signs: few strings, high entropy, a tiny import table, sections named UPX0.

  • Known packers (e.g. UPX) often have an unpacker: upx -d sample.exe.
  • Custom packers require manual unpacking: run under a debugger to the original entry point (OEP) after the stub decrypts the real payload, then dump the unpacked image from memory. Sandboxes that dump memory (CAPE) frequently recover the unpacked payload for you.

Anti-analysis evasion

Section titled “Anti-analysis evasion”

Malware actively resists analysis; recognize and defeat the common tricks:

  • Anti-VM / anti-sandbox — checks for VM artifacts, low core/RAM counts, or short uptime, and stays dormant if detected. Mitigate by hardening the lab VM and using bare-metal or anti-anti-VM tooling.
  • Anti-debugging — IsDebuggerPresent, timing checks, breakpoint detection. Use debugger hide plugins.
  • Obfuscation & stalling — junk code, string encryption, long sleeps to outlast automated sandboxes. capa/FLOSS and patient manual analysis cut through it.
Section titled “Related”