0% found this document useful (0 votes)

55 views

Basic Analysis-Malware Analysis-Fall2015

This document provides an overview of basic malware analysis techniques. It discusses using a virtual machine for malware analysis which provides safety, consistency and the ability to revert to earlier snapshots. It covers static analysis which analyzes a sample without executing code to infer functionality. Dynamic analysis analyzes what happens when a sample is executed, such as files created or websites contacted. Hands-on analysis of samples is recommended using tools available in the virtual machine. Related readings from the book "Practical Malware Analysis" are referenced for further study.

Uploaded by

Ano nym

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

55 views

Basic Analysis-Malware Analysis-Fall2015

Uploaded by

Ano nym

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 15

Basic Analysis

Malware Analysis
CSCI 4976 - Fall 2015
Branden Clark

RPISEC - 08/29/2014 Meeting Title 1

Overview
• Your malware analysis VM
• Static Analysis
• Dynamic Analysis

RPISEC - 08/29/2014 Meeting Title 2

Virtual Machines
• What is a virtual machine?
–Simply, a computer in your computer
–Really, a (usually) segregated virtual
environment that emulates real
hardware
•There are different types/methods that we’ll
discuss later

RPISEC - 08/29/2014 Meeting Title 3

Virtual Machines
• Why are we using a virtual machine?
–Safety, reliability, consistency, it’s easy
–Keep the malware in a contained environment
–Snapshots
•Completely 100% revert the VM to an earlier state
•If things go bad, no one cares

RPISEC - 08/29/2014 Meeting Title 4

Virtual Machines
• What’s in mine?
–Free Microsoft IE testing VM license
– Lots of free tools all pre-setup for you (C:\tools)
•Common ones are linked on the desktop
•symlinks to desktop and tools directory in cygwin
home dir
•debuggers, disassemblers, analyzers, unpackers,
compilers… the list goes on
•You’ll know them all soon enough!

RPISEC - 08/29/2014 Meeting Title 5

Overview
• Your malware analysis VM
• Static Analysis
• Dynamic Analysis

RPISEC - 08/29/2014 Meeting Title 6

Static Analysis
• Analyzing a sample without executing any
code
• Safe(r)
•Infer functionality
• Provides good pointers to guide dynamic
and advanced analysis
• Lots of tools involved!

RPISEC - 08/29/2014 Meeting Title 7

Static Analysis
• Can be an easy way to find signatures
–URLs, filenames, registry keys
•But it’s not always so easy!

RPISEC - 08/29/2014 Meeting Title 8

Hands on
• VM time!

If your VM isn’t working, don’t worry.

Just jot down the tools and the process.
We’ll resolve any issues and review at office
hours!

RPISEC - 08/29/2014 Meeting Title 9

Overview
• Your malware analysis VM
• Static Analysis
• Dynamic Analysis

RPISEC - 08/29/2014 Meeting Title 10

Dynamic Analysis
• Analyze what happens when the sample is
executed
• Are files made, processes created,
websites contacted, files downloaded/
executed, etc
• Shows you the effect the malware has on
the system/network

RPISEC - 08/29/2014 Meeting Title 11

Hands on
• VM time!

If your VM isn’t working, don’t worry.

Just jot down the tools and the process.
We’ll resolve any issues and review at office
hours!

RPISEC - 08/29/2014 Meeting Title 12

Lab
• Friday 09/04, same place same time
• Problems will be similar to those you saw
today
• Must answer a few questions about each
sample
–See the PMA Chapter Labs for examples

RPISEC - 08/29/2014 Meeting Title 13

Additional Material
• Related Readings:
– Practical Malware Analysis
• Chapter 1. Basic Static Analysis
• Chapter 2. Malware Analysis in Virtual Machines
• Chapter 3. Basic Dynamic Analysis

The chapter outlines make a great reference

Malware - 09/01/2015 Introduction 14

References
1. Sikorski, Michael, and Andrew Honig. Practical Malware Analysis the
Hands-on Guide to Dissecting Malicious Software. San Francisco: No
Starch, 2012. Print.

Malware - 09/08/2015 Advanced Static Analysis 15

Malware Analysis Sandbox: Project On
100% (1)
Malware Analysis Sandbox: Project On
16 pages
SANS FOR610 - Reverse-Engineering Malware: Malware Analysis Tools and Techniques
No ratings yet
SANS FOR610 - Reverse-Engineering Malware: Malware Analysis Tools and Techniques
40 pages
COBIT 4 To 5 Mapping
No ratings yet
COBIT 4 To 5 Mapping
20 pages
Practical Malware Analysis - Part 2 Dynamic Analysis
No ratings yet
Practical Malware Analysis - Part 2 Dynamic Analysis
33 pages
Wiley - Data Structures and Algorithms in C++, 2nd Edition - 978-0-470-38327-8
No ratings yet
Wiley - Data Structures and Algorithms in C++, 2nd Edition - 978-0-470-38327-8
3 pages
Practical Malware Analysis
No ratings yet
Practical Malware Analysis
65 pages
CMSC 449 - Lec2 - Basic Static Analysis
No ratings yet
CMSC 449 - Lec2 - Basic Static Analysis
28 pages
Basic Malware
No ratings yet
Basic Malware
15 pages
Lab1 Intro Malware Analysis
No ratings yet
Lab1 Intro Malware Analysis
5 pages
Malware Analysis
No ratings yet
Malware Analysis
35 pages
Intro. To Malware Analysis - 20313
No ratings yet
Intro. To Malware Analysis - 20313
22 pages
Hacking The Malware
100% (4)
Hacking The Malware
26 pages
Malware Analysis
100% (1)
Malware Analysis
26 pages
ch2 3
No ratings yet
ch2 3
45 pages
Malware Analysis
No ratings yet
Malware Analysis
33 pages
SCTS 242: Network Intrusion Detection and Penetration Testing
No ratings yet
SCTS 242: Network Intrusion Detection and Penetration Testing
21 pages
Systembc Root Access Trojan Malware Analysis Report
No ratings yet
Systembc Root Access Trojan Malware Analysis Report
17 pages
Section 6- Malware Forensics.pptx
No ratings yet
Section 6- Malware Forensics.pptx
51 pages
Introduction To Malware Analysis
100% (1)
Introduction To Malware Analysis
22 pages
HT-T09 - Practical Malware Analysis Essentials For Incident Responders
No ratings yet
HT-T09 - Practical Malware Analysis Essentials For Incident Responders
44 pages
Slides Malware Analysis Incident Response SBC ENG 23
No ratings yet
Slides Malware Analysis Incident Response SBC ENG 23
35 pages
malware report
No ratings yet
malware report
26 pages
Malware
No ratings yet
Malware
65 pages
Video 1 The Malware Analysis 101 Project
No ratings yet
Video 1 The Malware Analysis 101 Project
10 pages
Week 1 - Lecture
No ratings yet
Week 1 - Lecture
46 pages
Basic Dynamic Analysis
No ratings yet
Basic Dynamic Analysis
46 pages
Malware Analysis
100% (1)
Malware Analysis
4 pages
MalwareAnalysis Report2S17
No ratings yet
MalwareAnalysis Report2S17
15 pages
Practical Malware Analysis
No ratings yet
Practical Malware Analysis
45 pages
Chapter 2. Malware Analysis in Vms
No ratings yet
Chapter 2. Malware Analysis in Vms
13 pages
Malware Reverse Engineering Part 1 Static Analysis
No ratings yet
Malware Reverse Engineering Part 1 Static Analysis
27 pages
Malware Analysis 101
No ratings yet
Malware Analysis 101
64 pages
Practical Malware Analysis
No ratings yet
Practical Malware Analysis
45 pages
Intro To Malware Analysis
No ratings yet
Intro To Malware Analysis
36 pages
DFOR510 Week13 UnknownCodeAnalysis
No ratings yet
DFOR510 Week13 UnknownCodeAnalysis
37 pages
Malware Analysis Professional
No ratings yet
Malware Analysis Professional
21 pages
Peppers Creative Component v 1
No ratings yet
Peppers Creative Component v 1
43 pages
TOPIC 1-Malware Analysis
No ratings yet
TOPIC 1-Malware Analysis
28 pages
Malware Analysis 1
No ratings yet
Malware Analysis 1
20 pages
Windows Malware Analysis Essentials - Sample Chapter
No ratings yet
Windows Malware Analysis Essentials - Sample Chapter
68 pages
Malware Project
No ratings yet
Malware Project
8 pages
Chap-1 (Malware Analysis) (Sem-5)
No ratings yet
Chap-1 (Malware Analysis) (Sem-5)
29 pages
Cyber Defense Forensic Analyst - Real World Hands-On Examples
No ratings yet
Cyber Defense Forensic Analyst - Real World Hands-On Examples
17 pages
Malware Analysis
No ratings yet
Malware Analysis
9 pages
Week 2 - Lecture
No ratings yet
Week 2 - Lecture
43 pages
MALWARE ANALYSIS
No ratings yet
MALWARE ANALYSIS
12 pages
Practical Malware Analysis Essentials For Incident Responders
No ratings yet
Practical Malware Analysis Essentials For Incident Responders
38 pages
Int251 Malware Analysis and Cyber Defence
No ratings yet
Int251 Malware Analysis and Cyber Defence
3 pages
Malware Analysis 27112023 055948pm
No ratings yet
Malware Analysis 27112023 055948pm
39 pages
Experiment 3.4
No ratings yet
Experiment 3.4
5 pages
ch2 3
No ratings yet
ch2 3
45 pages
Malware Lab Concept
No ratings yet
Malware Lab Concept
44 pages
Malware Analysis Fundamentals Workshop
No ratings yet
Malware Analysis Fundamentals Workshop
13 pages
Introduction To Malware
No ratings yet
Introduction To Malware
86 pages
Ccs 21
No ratings yet
Ccs 21
17 pages
Malware Analysis
No ratings yet
Malware Analysis
15 pages
Important Topics INT 251
No ratings yet
Important Topics INT 251
2 pages
Week 1 MA
No ratings yet
Week 1 MA
23 pages
03 Analyzing Windows Programs
No ratings yet
03 Analyzing Windows Programs
17 pages
Mastering Nikto: A Comprehensive Guide to Web Vulnerability Scanning: Security Books
From Everand
Mastering Nikto: A Comprehensive Guide to Web Vulnerability Scanning: Security Books
Erwin Dirks
No ratings yet
Mastering Test Automation: A Practical Guide to Scalable & Efficient Testing
From Everand
Mastering Test Automation: A Practical Guide to Scalable & Efficient Testing
Chizitere Sylvia Olebu
No ratings yet
Professional Test Driven Development with C#: Developing Real World Applications with TDD
From Everand
Professional Test Driven Development with C#: Developing Real World Applications with TDD
James Bender
No ratings yet
1.2.e. PI - Mesin Proses Tekstil
No ratings yet
1.2.e. PI - Mesin Proses Tekstil
2 pages
Inkscape Manuals Readthedocs Io en Latest
No ratings yet
Inkscape Manuals Readthedocs Io en Latest
241 pages
Wiley - Data Structures and Algorithms in C++, 2nd Edition - 978!0!470-38327-8
No ratings yet
Wiley - Data Structures and Algorithms in C++, 2nd Edition - 978!0!470-38327-8
3 pages
DBMS Notes
No ratings yet
DBMS Notes
12 pages
Tdbconnection: Tdbinput Standard Properties
No ratings yet
Tdbconnection: Tdbinput Standard Properties
6 pages
R12 Cloning Steps
No ratings yet
R12 Cloning Steps
15 pages
ORacle DBA Brochure
No ratings yet
ORacle DBA Brochure
9 pages
5.2K Full Valid Mail Access Mix by MegaCloud 16.04[1]
No ratings yet
5.2K Full Valid Mail Access Mix by MegaCloud 16.04[1]
89 pages
Requirements Validation
No ratings yet
Requirements Validation
24 pages
Semester 4 Syllabus
No ratings yet
Semester 4 Syllabus
9 pages
The Role of Cybersecurity in Remote Sensing and Geographical Information System GIS
No ratings yet
The Role of Cybersecurity in Remote Sensing and Geographical Information System GIS
5 pages
Chapter -8 Introduction to Database Class x q and A
No ratings yet
Chapter -8 Introduction to Database Class x q and A
2 pages
Section 8
No ratings yet
Section 8
8 pages
ETL - Interview Question&Answers-2
No ratings yet
ETL - Interview Question&Answers-2
51 pages
UPortal5 The Path Forward
No ratings yet
UPortal5 The Path Forward
38 pages
Akami - Pci-Dss-3.2-Responsibility-Matrix
No ratings yet
Akami - Pci-Dss-3.2-Responsibility-Matrix
38 pages
REV00 Mitel TA7100 Reference Guide
No ratings yet
REV00 Mitel TA7100 Reference Guide
1,101 pages
ICT3713 Portfolio PDF
No ratings yet
ICT3713 Portfolio PDF
11 pages
Container Security Best Practices Cheat Sheet
No ratings yet
Container Security Best Practices Cheat Sheet
9 pages
The Mutual Exclusion Problem: Section 3
No ratings yet
The Mutual Exclusion Problem: Section 3
23 pages
Information Assurance and Security (IAS)
No ratings yet
Information Assurance and Security (IAS)
27 pages
Corelight-And-cPacket Proactive Cybersecurity SolutionBrief
No ratings yet
Corelight-And-cPacket Proactive Cybersecurity SolutionBrief
2 pages
Shorebase Project Rev 2
No ratings yet
Shorebase Project Rev 2
1 page
How Business Can Use ERP and AI To Become Intelligent Enterprise
No ratings yet
How Business Can Use ERP and AI To Become Intelligent Enterprise
4 pages
Event ID 1001
0% (3)
Event ID 1001
10 pages
PR Extraction v1
No ratings yet
PR Extraction v1
17 pages
Pki Card Offer Alotigier
No ratings yet
Pki Card Offer Alotigier
27 pages
WF Mailer Setup For A Dev/test Environment
No ratings yet
WF Mailer Setup For A Dev/test Environment
9 pages
Create Calculation View - SQL Script Table Functions Procedure
No ratings yet
Create Calculation View - SQL Script Table Functions Procedure
12 pages
SAP EWM Tables
No ratings yet
SAP EWM Tables
5 pages
Master Nygård Klaus 2015 PDF
No ratings yet
Master Nygård Klaus 2015 PDF
80 pages
Javadatabasse
No ratings yet
Javadatabasse
26 pages

Basic Analysis-Malware Analysis-Fall2015

Uploaded by

Basic Analysis-Malware Analysis-Fall2015

Uploaded by

Basic Analysis

RPISEC - 08/29/2014 Meeting Title 1

RPISEC - 08/29/2014 Meeting Title 2

RPISEC - 08/29/2014 Meeting Title 3

RPISEC - 08/29/2014 Meeting Title 4

RPISEC - 08/29/2014 Meeting Title 5

RPISEC - 08/29/2014 Meeting Title 6

RPISEC - 08/29/2014 Meeting Title 7

RPISEC - 08/29/2014 Meeting Title 8

If your VM isn’t working, don’t worry.

RPISEC - 08/29/2014 Meeting Title 9

RPISEC - 08/29/2014 Meeting Title 10

RPISEC - 08/29/2014 Meeting Title 11

If your VM isn’t working, don’t worry.

RPISEC - 08/29/2014 Meeting Title 12

RPISEC - 08/29/2014 Meeting Title 13

The chapter outlines make a great reference

Malware - 09/01/2015 Introduction 14

Malware - 09/08/2015 Advanced Static Analysis 15

You might also like