GREM · Domain 1
Malware Analysis Fundamentals
About 25% of the exam
Four levels of analysis
- Automated triage
- Static properties
- Interactive behavior
- Code reversing
- Each level costs more and reveals more
- Stop when the question is answered
- Static describes, dynamic demonstrates
- Code analysis explains the logic
- Hybrid work beats either method alone
Start cheap and broad, escalate only where the sample refuses to explain itself
Triage first moves
- Hash the sample before touching it
- Check reputation without uploading blindly
- Record file size, type and timestamps
- Identify the real format, not the extension
- Pull strings and imports for direction
- Measure entropy across the sections
- Note whether it needs command line arguments
Malware by purpose
- Dropper
- carries and writes the payload
- Downloader
- fetches the payload from elsewhere
- Loader
- maps and launches code in memory
- Backdoor
- gives the operator persistent access
- Trojan
- pretends to be wanted software
- Ransomware
- encrypts, deletes recovery, demands payment
- Rootkit
- hides itself and other components
- Wiper
- destruction disguised as extortion
Laboratory design
- Isolate the analysis network completely
- Prefer host only or simulated internet
- Snapshot before every execution
- Keep the analysis host off the corporate domain
- Simulate services so the sample talks
- Treat the whole laboratory as contaminated
Network access to the real internet can alert the operator and pull live payloads you cannot control
Portable executable anatomy
Headers
- Signature bytes mark the format
- Characteristics distinguish executable from library
- Machine field states the architecture
- Compile timestamp can be forged
- Entry point where execution begins
Sections
- Code section holds executable instructions
- Read only data holds strings and constants
- Writable data holds variables
- Resources hold icons and embedded files
- Overlay is data beyond the last section
Suspicious signs
- Section both writable and executable
- Virtual size far exceeding raw size
- Unusual or vendor specific section names
- Entry point outside the code section
- Almost no imports listed
A tiny import table with a loader pair present usually means the real imports resolve at runtime
Imports that tell a story
- Library and address lookup
- resolves functions at runtime
- Remote allocate and write
- injection into another process
- Create remote thread
- runs the injected code
- Hook installation
- monitoring or injection into windows
- Key state polling
- keylogging behavior
- Internet transfer calls
- download or command channel
- Service and registry writes
- persistence being installed
- Debugger checks
- anti-analysis logic present
Strings triage
- Extract both narrow and wide strings
- Look for hosts, paths and mutex names
- Encoded blobs deserve decoding
- Command line fragments reveal the intent
- Too few strings suggests packing
- Stack built strings hide from extraction
Entropy and packing
- High entropy suggests compression or encryption
- Compare entropy section by section
- Compressed archives raise entropy legitimately
- Large overlays may hold the real payload
- Packer names sometimes appear in sections
- Language runtimes distort simple packer heuristics
Signature rules
- Strings block
- text, hex and regular expressions
- Condition
- logic that decides a match
- Counting condition
- match a minimum number of strings
- Metadata
- author, reference and description fields
- Entropy function
- flag packed or encrypted regions
- Memory scanning
- unpacked code matches where disk failed
Write rules against what the family must keep, not against bytes a rebuild will change
Sandbox reality check
Why it stays quiet
- Detected virtual machine artifacts
- Missing arguments or missing files
- Long sleep beyond the analysis window
- Waiting for user interaction
- Command server already offline
What to change
- Mask obvious virtualization indicators
- Provide the expected arguments and paths
- Simulate the network services it expects
- Extend the run and generate activity
- Populate the machine with realistic files
Reporting honestly
- A clean report is not a clean sample
- State the environment and duration
- List behaviors observed and not observed
- Record any evasion checks you saw
Indicators to extract
- File hashes for the sample and drops
- Mutex and named pipe strings
- Domains, addresses and request paths
- Registry keys and service names
- Scheduled task names and triggers
- Certificate details of signed samples
Reporting a sample
- State the capability, not the adjective
- Separate observed behavior from inference
- Give detection ideas that survive rebuilds
- List indicators with their confidence
- Note the analysis limits honestly
- Recommend containment actions that follow
Key artifacts
- Format signature
- first bytes identify the file type
- Import table
- functions the loader resolves
- Section table
- layout, sizes and permissions
- Resource directory
- icons, configuration and embedded files
- Overlay
- appended data after the sections
- Mutex
- single instance marker, strong indicator
- Compile timestamp
- useful but easily forged
Know the order
- Hash and record
- Identify the format
- Static properties review
- Behavioral run
- Escalate to code
- Extract indicators
Snapshot, run, observe, revert: never analyze twice from a machine you already contaminated
Reference strip: triage toolkit
Static properties
- Hashes and fuzzy hashes
- File type and architecture
- Sections, entropy and overlay
- Imports, exports and resources
Behavioral signals
- Files created and modified
- Registry and service changes
- Processes spawned and injected
- Network connections attempted
Laboratory controls
- Isolated or simulated network
- Snapshot and revert every run
- No corporate credentials present
- Monitoring from outside the guest
Evasion checks
- Virtual machine artifacts and drivers
- Processor count and memory size
- Screen resolution and user activity
- Long sleeps and timing checks
Deliverables
- Capability summary in plain words
- Indicators with confidence
- Detection rules that survive rebuilds
- Containment and hunting recommendations
Quick exam traps
- Trap: A sandbox report showing nothing means the file is safe
- Trap: The compile timestamp reliably dates the build
- Trap: High entropy always proves the sample is packed
- Trap: A small import table means the code does very little
- Trap: Static analysis alone can confirm the command server
- Trap: Running the sample once with internet access is harmless
- Trap: Detection rules built on the current hash will keep working
cybercertprep.com · original revision sheet written from the public body of knowledge