More Related Content
Similar to CHAPTER 1 MALWARE ANALYSIS PRIMER.ppt (20)
More from ManjuAppukuttan2 (17)
Recently uploaded (20)
![[HIFLUX] High Pressure Tube Support Catalog 2025](https://cdn.slidesharecdn.com/ss_thumbnails/tubesupporten-250529073613-16c22974-thumbnail.jpg?width=560&fit=bounds)
![[HIFLUX] Lok Fitting&Valve Catalog 2025 (Eng)](https://cdn.slidesharecdn.com/ss_thumbnails/lokfittingen-250528072439-8696f1c6-thumbnail.jpg?width=560&fit=bounds)
CHAPTER 1 MALWARE ANALYSIS PRIMER.ppt
- 1. Chapter 1 Malware Analysis Primer Prepared by, Dr. A. Manju, M.E., Ph.D, Assistant Professor, SRM Institute of Science & Technology, Ramapuram Campus Michael Sikorski, Practical Malware Analysis The Hands-On Guide to Dissecting Malicious Software, Kindle Edition, No Starch Press; 1 edition (1 February 2012), ISBN: 1593272901
- 2. Outline The Goals of Malware Analysis Malware Analysis Techniques Types of Malware General Rules for Malware Analysis
- 3. The Goals of Malware Analysis The purpose of malware analysis is usually to provide the information you need to respond to a network intrusion. Your goals will typically be to determine exactly what happened, and to ensure that youve located all infected machines and files. When analyzing suspected malware, your goal will typically be to determine exactly what a particular suspect binary can do, how to detect it on your network, and how to measure and contain its damage. Once you identify which files require full analysis, its time to develop signatures to detect malware infections on your network.
- 4. The Goals of Malware Analysis Host-based signatures, or indicators, are used to detect malicious code on victim computers. These indicators often identify files created or modified by the malware or specific changes that it makes to the registry. Unlike antivirus signatures, malware indicators focus on what the malware does to a system, not on the characteristics of the malware itself, which makes them more effective in detecting malware that changes form or that has been deleted from the hard disk. Network signatures are used to detect malicious code by monitoring network traffic. Network signatures can be created without malware analysis, but signatures created with the help of malware analysis are usually far more effective, offering a higher detection rate and fewer false positives.
- 5. Malware Analysis Techniques There are two fundamental approaches to malware analysis: o static and o dynamic. Static analysis involves examining the malware without running it. Dynamic analysis involves running the malware.
- 6. Malware Analysis Techniques Both techniques are further categorized as basic or advanced. Basic Static Analysis: o Examining the executable file without viewing the actual instructions. o Confirm whether a file is malicious, provide information about its functionality, and sometimes provide information that will allow you to produce simple network signatures. o Straightforward and can be quick, but its largely ineffective against sophisticated malware, and it can miss important behaviors. Basic Dynamic Analysis: o Involve running the malware and observing its behavior on the system in order to remove the infection, produce effective signatures, or both. o However, before you can run malware safely, you must set up an environment that will allow you to study the running malware without risk of damage to your system or network. o Basic dynamic analysis techniques can be used by most people without deep programming knowledge, but they wont be effective with all malware and can miss important functionality.
- 7. Malware Analysis Techniques Advanced Static Analysis: o consists of reverse-engineering the malwares internals by loading the executable into a disassembler and looking at the program instructions in order to discover what the program does. o The instructions are executed by the CPU, so advanced static analysis tells you exactly what the program does. o It has a steeper learning curve than basic static analysis and requires specialized knowledge of disassembly, code constructs, and Windows operating system concepts. Advanced Dynamic Analysis: o Uses a debugger to examine the internal state of a running malicious executable. o Provide another way to extract detailed information from an executable. o These techniques are most useful when youre trying to obtain information that is difficult to gather with the other techniques.
- 8. Types of Malware Backdoor: Malicious code that installs itself onto a computer to allow the attacker access. Backdoors usually let the attacker connect to the computer with little or no authentication and execute commands on the local system. Botnet: Similar to a backdoor, in that it allows the attacker access to the system, but all computers infected with the same botnet receive the same instructions from a single command-and-control server. Downloader: Malicious code that exists only to download other malicious code. Downloaders are commonly installed by attackers when they first gain access to a system. The downloader program will download and install additional malicious code.
- 9. Types of Malware Information-stealing malware: Malware that collects information from a victims computer and usually sends it to the attacker. Examples include sniffers, password hash grabbers, and keyloggers. This malware is typically used to gain access to online accounts such as email or online banking. Launcher: Malicious program used to launch other malicious programs. Usually, launchers use non-traditional techniques to launch other malicious programs in order to ensure stealth or greater access to a system. Rootkit: Malicious code designed to conceal the existence of other code. Rootkits are usually paired with other malware, such as a backdoor, to allow remote access to the attacker and make the code difficult for the victim to detect.
- 10. Types of Malware Scareware: Malware designed to frighten an infected user into buying something. It usually has a user interface that makes it look like an antivirus or other security program. It informs users that there is malicious code on their system and that the only way to get rid of it is to buy their software, when in reality, the software its selling does nothing more than remove the scareware. Spam-sending malware: Malware that infects a users machine and then uses that machine to send spam. This malware generates income for attackers by allowing them to sell spam- sending services. Worm or virus: Malicious code that can copy itself and infect additional computers.
- 11. General Rules of Malware Analysis Most malware programs are large and complex, and you cant possibly understand every detail. First, focus on the key features. When you run into difficult and complex sections, try to get a general overview before you get stuck in the weeds. Second, remember that different tools and approaches are available for different jobs. There is no one approach. If you get stuck, dont spend too long on any one issue; move on to something else. Try analyzing the malware from a different angle, or just try a different approach. Finally, remember that malware analysis is like a cat-and-mouse game. As new malware analysis techniques are developed, malware authors respond with new techniques to thwart analysis. To succeed as a malware analyst, you must be able to recognize, understand, and defeat these techniques, and respond to changes in the art of malware analysis.