> For the complete documentation index, see [llms.txt](https://shahidmobin.gitbook.io/infosec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shahidmobin.gitbook.io/infosec/what-and-why.md).

# What and Why

What is malware analysis and why it is useful?

Anti-Virus cannot be relied on

50% to 97% of breaches involve malware

### Breach Happens- Then What?

#### Typical:

Reimage the machine

#### Advanced: Incident Response

Analyze logs, network traffic, strange processes, etc.

is it anywhere else?

How did it get there?

#### Mature: Gather Intelligence

What is the impact?

What is the Risk?

Financially motivate? Hacktivism? Opportunistic? APT?

#### Read: Verizon Data Breach report 2015

### Scope

#### Beginner's Intro to

Windows Malware Analysis

Basic Forensics/ Incident Response / Malware Discovery

Basic Reverse Engineering

#### Recommended Background

Networking - TCP/IP, Operating System Internals, Programming (C, C++), Software Vulnerabilities, Hacking

### What is Malware?

Malicious Software, Executes without permission or Knowledge

#### Software problems like every other product:

Compatibility issues, Bugs, customer service, versions/updating issues, Team Development/ Source code control

### Malware Types/Functionality

#### General

Virus (File Infector Rare)

Trojan (Common)

Worm (Rare)

Bot (Very Common)

Rootkits (Uncommon)

RAT (Very Common)

#### More Specialized

Scareware

Spyware

Adware

Backdoors

Credential Stealers

Anti-Analysis

Defenses

Stealth

Loader / Downloader

#### Other Malicious Software

Builders

Exploit Kit

Packer/ Crypter

### Types of Analysis

#### Dynamic analysis

Executing the malware. Simple, fast, easy to miss things

#### Static Analysis

Reverse Engineering. Slow, Deep technical Knowledge. With enough time anything can be reversed

#### Hybrid Static/ Dynamic

Most analysis is a mixture: you find something in the disassembly then you confirm/investigate while the malware is executing.

Memory Forensics. Can be very useful, but is not the end-all-be-all

### Tools

{% embed url="<https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite>" %}
Sysinternals
{% endembed %}

[MAP Pack](http://sandsprite.com/tools.php) (Malware analysis pack)

{% embed url="<https://www.sweetscape.com/>" %}
010
{% endembed %}

PE viewer: CFF explorer, PE Explorer, PE View, PE Studio

A disassembler: IDA Pro, x64\_dbg, Hopper, etc

#### other (personal preference)

Cygwin - packages (MD5sum, gcc, xxd, file, string, python , binutils) <https://cygwin.com/install.html>

Notepad++

7Zip

### Sample Viruses

![sample Viruses can be tested](https://2598763549-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MV1yONFz7_3Y-mosQ2u%2F-MV23Is5mfHv_EpNDN1n%2F-MV29iuwU0QY9zvkPBUN%2FScreen%20Shot%202021-03-05%20at%2017.13.24.png?alt=media\&token=43c5796f-0db2-4104-8f0d-293cc5b624c3)

Some malware can be executed upon: Being Scanned, Viewing the icon: Word, PDF, system icon, Extracting the file from an archive

MD5 vs SHA256

![Books](https://2598763549-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MV1yONFz7_3Y-mosQ2u%2F-MV23Is5mfHv_EpNDN1n%2F-MV2B3KAMlrbxcWwpgx5%2FScreen%20Shot%202021-03-05%20at%2017.19.28.png?alt=media\&token=ffa3a0b4-e423-41ab-90a1-40b323109110)