Static Analysis, Dynamic Analysis & IOC Extraction
Section 10 of 12
Definition: Process of studying malicious software to understand its functionality, origin, and impact on systems.
NEVER analyze malware on production systems! Always use isolated virtual machines with no network access or use sandbox environments specifically designed for malware analysis.
Examining malware without executing it - safe initial analysis step.
# Calculate hashes
md5sum malware.exe
sha256sum malware.exe
# Extract strings
strings malware.exe > strings.txt
strings -el malware.exe >> strings.txt # Unicode
# File type
file malware.exe
# Check if packed
detect-it-easy malware.exe
# PE analysis
pefile malware.exe
Executing malware in a controlled environment to observe behavior.
HKCU\Software\Microsoft\Windows\
CurrentVersion\Run
HKLM\Software\Microsoft\Windows\
CurrentVersion\Run
HKCU\Software\Microsoft\Windows\
CurrentVersion\RunOnce
HKLM\System\CurrentControlSet\
Services
HKCU\Software\Microsoft\Windows NT\
CurrentVersion\Winlogon\Shell
Open-source automated malware analysis system
# Submit file for analysis
cuckoo submit malware.exe
# Submit with specific options
cuckoo submit --package exe --timeout 120 malware.exe
# Submit URL
cuckoo submit --url http://malicious.com/payload.exe
# View results
cuckoo web runserver
# Generate report
cuckoo report <task_id>
Warning: Results become public!
Extract artifacts that can be used to detect and hunt for malware across the network.
# Extract IPs
strings malware.exe | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}'
# Extract URLs
strings malware.exe | grep -oE 'https?://[^\s]+'
# Extract domains
strings malware.exe | grep -oE '[a-zA-Z0-9\-]+\.[a-zA-Z]{2,}'
# Extract file paths
strings malware.exe | grep -E '[A-Z]:\\.+'
YARA is a pattern-matching tool used to identify and classify malware based on textual or binary patterns.
rule Ransomware_Generic
{
meta:
description = "Detects generic ransomware indicators"
author = "Forensics Team"
date = "2025-12-03"
strings:
$s1 = "Your files have been encrypted" nocase
$s2 = "Bitcoin" nocase
$s3 = ".onion" ascii
$s4 = "ransom" nocase
$api1 = "CryptEncrypt" ascii
$api2 = "CryptGenKey" ascii
condition:
(2 of ($s*)) and (1 of ($api*))
}
# Scan single file
yara rules.yar malware.exe
# Scan directory recursively
yara -r rules.yar /path/to/scan/
# Use rule set
yara -C rules/ suspicious_file
# Fast mode
yara -f rules.yar file
Interactive disassembler
NSA reverse engineering tool
Open-source debugger for Windows
Portable executable analysis
Sysinternals real-time monitoring
Memory forensics framework
Malware often employs techniques to evade analysis and detection.