Table of Contents
Introduction
Do you know what is malware analysis?
In this article I’ll try to explain in a simple way what is malware analysis and what are the main steps to follow in a malware analysis process.
In summary: it’s the process of determining the functionality, origins and potential impact of a given malware sample.
This process is reverse engineering of a given sample in order to determine how it works.
Obtained information can then be used to develop countermeasures and defenses against the malware in question.
What is a malware
Malware is short for “malicious software“:
Malware is any software that is designed to intentionally cause disruption to a computer, server, client, or computer network.
This software can leak private information, gain unauthorized access to information or systems, or deprive users of access to information.
Additionally, malware can interfere with a user’s computer security and privacy without the user’s knowledge.
Types of malware
There are many types of malware, but the best known are:
- Virus: Replicates itself and spread to other computers attaching to a file and with the user interaction.
- Worm: Spreads itself without the need to attach itself to other files or programs and with no user interaction.
- Trojan: Appears a legitimate software.
- Spyware: Collects information about a user without his knowledge.
- Adware: Displays advertising.
- Ransomware: Encrypts a user’s files and asks a ransom for the decryption key.
Static Analysis vs Dynamic Analysis
The common ways to conduct a Malware Analysis are:
- Static Analysis
- Dynamic Analysis
Both can be manual or automated.
With static analysis an analyst can examine the code of a malware sample without actually executing it.
This can be useful for understanding the general behavior and purpose of the malware, but may not provide detailed information about how the malware works.
In contrast, during a dynamic analysis, the analyst executes the malware in a controlled environment (Sandbox) in order to observe its behavior.
This can provide more detailed information about the functionality of the malware, but with additional risks:
the malware can cause damage or harm to systems.
Anyway, the most effective approach almost always turns out to be the hybrid one.
Malware authors try also to prevent analysis through code obfuscation and evasion.
Conclusion
The article is only meant to be an introduction to understanding malware analysis, which has only been superficially treated.
In conclusion, the main benefit is that it can help security professionals to understand how malware works and how stop it.
This understanding can then help developing better security measures to protect against future attacks.
However, malware analysis can also be time-consuming and expensive, and it may not always be possible to obtain all the information needed to understand a piece of malware.
In addition, malware analysis can sometimes inadvertently give attackers information about how to bypass security measures.
