Practical Malware Analysis A COMP6441 Something-Awesome project!
Turns out open learning blogs aren’t visible unless you have an account. Here’s a repost.
Summary
After 30+ hours of reading, write ups, research and analysis did I achieve what I set out to accomplish?
Final Assessment of Project
Part 1: Virtual Network Setup
How can we analyse malware safely and not infect our machine? The answer is to use a virtual machine that is separate from the host.
My lab contained a custom network; A service machine on Ubuntu, malware analysis machine on Windows XP and I decided to run IDA Pro on Windows 7. The service machine simulated network responses so I could study the malware's network indicators.
Basic Static analysis consists of examining the executable file to collect information about its function and network signatures. Basic Static analysis is straightforward and quick but it is ineffective against sophisticated malware.
Notes
Lab 01-01 Lab 01-02 Lab 01-03
Part 3: Basic Dynamic Analysis
This stage involved running the malware, in order to observe its behavior.
Notes
Lab 02-01 Lab 02-02 Lab 02-03
Part 4: x86 Assembly Architecture
The necessary knowledge to perform advanced static analysis. This chapter was very content-heavy and as such the author did not include lab work. The concepts were put into practice in the next chapter.
Notes
Part 5: Advanced Static Analysis
Advanced static analysis consists of reverse engineering the malware's internals by loading the executable into a disassembler. The process can reveal the underlying functions of the malware. However, the technique has a very steep learning curve. This week focused on reverse-engineering a malware. Guidance was provided through questions.
Notes
Lab 05-01 Lab 05-02 Lab 05-03
Supplementary Research
The book was outdated in many sections and some concepts were breezed over. I often had to research myself.
