Malware over the past decades has become one of the most critical threats to various sectors and entities, ranging from normal endpoint devices to critical infrastructure and other organizations. Even most, if not all, of the final stages of each compromise rely on malware. Computer security researchers and malware analysts have developed different toolkits to understand malware samples and dissect them in order to understand their intent, functionalities, capabilities, stealth mechanisms, malware infrastructure, and more.

But the main question is: is malware analysis just about tools and premium kits for dissecting and inspecting malware? This is the mistake that most junior and even some other analysts fall into.

First, we need to understand what a tool or software actually is. In basic terms and definition, a tool or software is something programmed to make human daily tasks easier. For example, Microsoft Office Writer allows writing hundreds of pages that were once limited to classic paper, now with different page setup sizes for writing various articles and documents.

What lies behind the tool is the external or internal set of data used to parse and understand the structure. You can imagine that ransomware does not know what an extension is unless the malware author has already configured it to recognize it or inserted it into a list of extension datasets. Without those pre-hardcoded or configured lists of extensions, ransomware does not actually know what or which files to encrypt.

Tools work with the same mechanism and follow the same approach, only with different configurations.

Malware analysis, by nature, is a challenging and complex field to adapt to. Most tools were developed years ago; some are outdated, while others are still being updated and improved. However, we should not forget that most of them work based on signature detection to recognize things such as packers.

For example, if a packer is unknown, or if a malware author reverse-engineers the packer and modifies section names such as UPX1 or UPX0 into random names, the tools may be unable to recognize which packer was used to pack the malware sample.

That is where mindset plays a critical role in the analysis stage, because in malware analysis, most, if not all, tools are fundamentally the same.

Examples include: Pestudio, Detect It Easy, Strings, HxD, IDA, Ghidra, Process Hacker, Autoruns, Procmon, API Monitor, x64dbg, and so on.

In general terms, these tools are effective and sufficient to understand malware behavior, functionalities, and capabilities. But the most important aspect is how to use those tools and what exactly you need from them.

Nowadays, you may not see malware of interest like in past decades that attracted security firms and the industry to analyze and publish long PDF reports for the community. Malware has mostly become a business today, such as MaaS (Malware as a Service).

In addition, it is now quite rare to see malware with an interesting initial delivery vector.

Last but not least, one trap that many analysts fall into is becoming bored during malware analysis, and I do not blame them at all. This is because what is common nowadays are infostealers, weaponized Office documents exploiting CVE-2017-0199 or CVE-2017-11882, or PDF documents asking users to click a link to update their software.

Until this point, everything is fine.

What is not fine is when analysts do not have clear goals before analyzing malware. There are several questions an analyst should ask before even touching the malware sample:

1- Why should I analyze this malware?

2- What is my goal in analyzing this malware?

3- What do I need to look for inside this malware?

4- What tools are effective for this stage of analysis?

Malware analysis is not about having different virtual environments for different purposes and maintaining large analysis toolkits. In reality, you may not need all of those tools to inspect malware.

Having many tools in your arsenal is good, but one of the main issues that causes analysts to fail is tool switching.

For example, switching from x64dbg to OllyDbg raises the question: if you already have x64dbg, why do you need OllyDbg? If the answer is plugins, x64dbg also supports plugins.

If you have Strings, why do you need BinText?

If you have Ghidra or Iaito/Radare2, why do you need Cutter or Binary Ninja?

If you already have a pattern-matching tool, why do you need a separate URL revealer?

However, we should not ignore that each tool has its own advantages and disadvantages.

An analyst should adjust their mindset to inspect and dissect malware samples effectively.

What I have seen from many junior analysts nowadays, and what I also did at the beginning of my journey, is performing a quick review of the sample by dragging and dropping it into different tools and then immediately jumping into dynamic analysis.

Dynamic analysis often shows what malware is doing, at least in most non-sophisticated cases. However, there are still valuable indicators that may be missed during static analysis.

You may ask: “If the malware is packed or obfuscated, why not just jump directly into dynamic and network analysis?”

The answer is that dynamic analysis is not a “bibbidi-bobbidi-boo” solution that reveals everything.

There are still static analysis approaches you can follow:

1- Unpack the malware if the packer can be unpacked using a public open-source tool.

2- If the malware is obfuscated, connect small indicators and patterns together until they provide meaningful context.

3- Dump stack strings using FLOSS if the malware does not provide strings of interest.

4- Look for Windows API functions related to registry, networking, or file activities.

You can validate these approaches through advanced static analysis.

This can be useful when the malware does not act as a dropper, downloader, stager, or loader in most cases. Samples often have different structures, different hash values, different import address tables, and clearer plaintext strings. They may appear different, but they are still connected.

Another mindset analysts should build is: never trust, always verify. Do not assume. Look for evidence and avoid cognitive bias. Focus on facts.

You should never forget that malware analysis is a cat-and-mouse game. Malware authors do their best to misdirect analysts because once you are misdirected, your analysis may no longer provide meaningful results.

Some common misdirection techniques include:

1- Junk code

2- Dead code

3- Junk strings

4- Unusable Windows API functions

Finally, you must understand that as a malware analyst, whether junior or senior, malware analysis is not something you can fully learn in a few weeks, through one course, or by reading one book.

Malware analysis is a field of experience.

I believe it is one of the fields that requires more hands-on experience than many others, because malware authors continuously develop new techniques, new methodologies, and new approaches every day.

The more samples you analyze, the more experience you gain. Day by day, you will begin to feel the difference in your analysis process.

The last thing I want to say to junior analysts is that you may not immediately see or feel your progress. Usually, it takes months or even years to clearly notice how much you have grown in this field.

You can compare it to growing your hair longer; most visible changes only become noticeable after several months.

However, try to focus on the binary platform you want to specialize in, for example:

• Windows malware analysis
• Linux malware analysis
• macOS malware analysis
• Android malware analysis
• iOS malware analysis

Each of these has its own approaches and methodologies.

The tools you use for Windows malware analysis may not be effective for Android malware analysis, and the same applies across other platforms.

Secjuice – ​Read More