From Fundamentals to Forensics: Exploring the Spectrum of Malware Analysis

This paper seeks to bring together fundamental and advanced techniques of malware analysis and understanding to prepare the malware analysts with strategic skills towards better investigations and insights [1]. The ever-increasing challenges posed by malware on computer networks require computer security specialists to possess a deep knowledge of the malware’s inner details and behaviors during execution. This paper outlines the malware analysis technique, starting from the basic approaches to the advanced techniques. The basic analysis includes both static and dynamic, where static is the examination of malware that has not been executed Operations like sample hashing, string analysis, and Portable Executable (PE) file header examination are collected, whereas in dynamic analysis the executable is run in a safe environment with INetSim running in the background, and its behavior is observed using software tools like Procmon, Wireshark, and TCPView. This document also discusses advanced static analysis consisting of disassembly and decompilation to analyze malware’s hidden code to gain insight on how it operates and the logic it uses. The use of Cutter as a program of API flow analysis and program flow visualization will help us to understand a lot more about the malware.