Skip to main content

Static Analysis

info

The content of this Malware Analysis pages is my understanding and notes based on the course Introduction to Malware Analysis by Prof. Ahmed Lekssays.

Overview​

Static Analysis involves examining the malware without executing it.

  • Advantages: Safe (no infection risk), reveals capabilities, identifies suspicious code.
  • Limitations: Cannot observe runtime behavior, defeated by packing/obfuscation.

Key Techniques​

1. File Properties​

Checking metadata, file size, timestamps, and digital signatures. Signatures can sometimes be stolen, but an invalid signature is a strong indicator.

2. String Analysis​

Extracting readable text from the binary.

  • What to look for: IP addresses, URLs, file paths, command-line arguments, or error messages that reveal functionality.

3. Header Analysis​

Examining the file structure (e.g., PE Header in Windows).

  • Imports/Exports: What system functions does it call? (e.g., InternetOpenUrl suggests network capability; WriteProcessMemory suggests injection).

Hashing: Crypto vs. Fuzzy​

Traditional cryptographic hashing is insufficient for tracking malware families.

The Failure of Traditional Hashing (SHA-256)​

Cryptographic hashes are designed for Collision Resistance (The Avalanche Effect). Changing a single bit in a file results in a completely different hash.

  • Malware Author: Changes 1 byte of code.
  • Result: New SHA-256 hash. The AV signature breaks.

The Solution: Fuzzy Hashing (SSDeep)​

SSDeep uses Context-Triggered Piecewise Hashing (CTPH). It divides the file into chunks based on content patterns.

  • Goal: Similarity preservation.
  • Result: malware_v1.exe and malware_v2.exe (with minor changes) will have a 99%99\% match score.

Allows analysts to identify variants of the same malware family.