(Absolute Basic Concepts) ABCs of Malware Analysis

Explore the absolute basics of malware analysis by defining malware, its typical malicious activities, and how it is distributed and targeted, then survey the major types of malware today.

Malware is software designed to damage or gain unauthorized access, authored by malware authors, ranging from commodity to APT, delivered via phishing, USB, email, or websites, including botnets.

Explore common malware types such as viruses, trojans, worms, ransomware, spyware, adware, botnets, rootkits, keyloggers, scareware, logic bombs, and backdoors, and how they combine to help build defenses against malware.

Explore fundamentals of malware analysis, examining binary files, libraries, and functions, addressing challenges in binary analysis, and introducing the PE file structure and obfuscation by malware authors.

Explore how applications are written in high level languages with text editors and compiled into portable binaries, enabling cross-platform execution for end users.

Explore how end-user machines run programs across four layers—user, application, operating system, and hardware—through Windows libraries and functions like get raw input data, create file operations, and registry actions.

Discover how malware analysis identifies a program’s function by examining binary files and strings, overcoming the challenges of reading machine code with specialized tools.

Explore the PE file structure, revealing why Windows executables are common and how the DOS header, PE header, optional header, and section table govern execution and malware analysis.

Hiding meaningful information in malware binaries, obfuscation delays analysis and detection. Explore packers, polymorphic and metamorphic code, dead code insertion, subroutine reordering, and instruction substitution.

Learn to build an isolated malware analysis lab in VirtualBox. Use host-only networking, no shared folders, and password-protected samples while preparing tools like HashCalc, HxD, PE Studio, and Process Monitor.

Demonstrate building a malware analysis lab by spinning up a Windows 7 virtual machine, installing tools like hashcalc and hxd, and disabling internet and antivirus to study a malware sample.

Learn malware analysis: determine functionality, origin, and potential impact of a sample, and assess its intentions and whether it targets systems. Compare analysis with alert handling to strengthen defense.

Explore the two core types of malware analysis - static analysis (code analysis) and dynamic analysis (behavior analysis). Learn how static analyzes code without execution, while dynamic analyzes behavior through controlled execution.

Examine static malware analysis phases to extract information from a binary without execution. Cross-check with antiviruses using hashes and VirusTotal, then perform string and PE analysis with PE studio.

this lecture demonstrates static malware analysis using a password-protected zip sample invoice.xlsx, revealed as a 32-bit upx-packed executable, using hashcalc, Exeinfo PE, and bintext for analysis.

Automated dynamic malware analysis uses sandboxes to run samples in virtual machines across various Windows versions with common apps, scoring behaviors to label files as clean, suspicious, or malicious.

Demonstrates automatic dynamic malware analysis using any.run, showing how to submit a Windows 7 32-bit sample, view reports, and observe network activity, IOCs, and static/behavioral details.