Workflow & Environment
The content of this Malware Analysis pages is my understanding and notes based on the course Introduction to Malware Analysis by Prof. Ahmed Lekssays.
The Realistic Analysis Workflow
Malware analysis is not a linear process; it is highly iterative.
- Triage (90% of Time)
Most samples are variations of known threats. The goal of triage is filtering:
Is it actually malware? (False positive check).
Is it known? (Hash lookups, YARA).
Is it worth deep analysis? (Cost-benefit analysis).
- Deep Investigation
If a sample passes triage, it undergoes:
Static Analysis: Code structure, strings, imports.
Dynamic Analysis: Sandbox execution, behavior monitoring.
Hybrid Analysis: Advanced deobfuscation or symbolic execution.
The process loops: Static analysis generates hypotheses ("What does this function do?"), which Dynamic analysis tests ("Let's run it and see").
Analysis Environment Setup
Virtual Machines (VM)
The standard approach involves using tools like VMware, VirtualBox, or QEMU.
Pros: Snapshot/restore capabilities, isolation from the host.
Cons: Malware is often "VM-aware."
Bare-Metal Analysis
Used when VM detection is sophisticated. Involves using dedicated "sacrificial" hardware that is wiped after every analysis.
Safety Guidelines
Network Isolation: Disconnect the analysis machine from production networks. Use tools like INetSim or FakeDNS to simulate the internet.
Host Protection: Never analyze malware on your personal host OS.
Data Protection: Store samples in encrypted archives (e.g., password "infected") to prevent accidental execution by antivirus.
The Sandbox Evasion Problem
A fundamental tension exists: Analysts need a controlled environment, but malware tries to detect it.
Common Detection Techniques
Artifacts: Checking for VMware registry keys, drivers, or specific MAC addresses.
Resource Checks: Refusing to run if RAM < 4GB or CPU cores < 2 (typical of default VMs).
Timing Checks: Using instructions like RDTSC or checking Sleep():
Malware logic: "I will sleep for 10 seconds."
Sandbox logic: "10 seconds is too long, I'll fast-forward time."
Malware detection: "The clock says 10 seconds passed, but the CPU cycle count didn't increase enough. I'm in a sandbox."
User Interaction: Checking if the mouse has moved recently (automated sandboxes rarely move the mouse).