Book Image

Learning Malware Analysis

By : Monnappa K A
5 (1)
Book Image

Learning Malware Analysis

5 (1)
By: Monnappa K A

Overview of this book

Malware analysis and memory forensics are powerful analysis and investigation techniques used in reverse engineering, digital forensics, and incident response. With adversaries becoming sophisticated and carrying out advanced malware attacks on critical infrastructures, data centers, and private and public organizations, detecting, responding to, and investigating such intrusions is critical to information security professionals. Malware analysis and memory forensics have become must-have skills to fight advanced malware, targeted attacks, and security breaches. This book teaches you the concepts, techniques, and tools to understand the behavior and characteristics of malware through malware analysis. It also teaches you techniques to investigate and hunt malware using memory forensics. This book introduces you to the basics of malware analysis, and then gradually progresses into the more advanced concepts of code analysis and memory forensics. It uses real-world malware samples, infected memory images, and visual diagrams to help you gain a better understanding of the subject and to equip you with the skills required to analyze, investigate, and respond to malware-related incidents.
Table of Contents (19 chapters)
Title Page
Copyright and Credits
Dedication
Packt Upsell
Contributors
Preface
Index

Summary


Dynamic analysis is a great technique to understand the behavior of malware and to determine its network and host-based indicators. You can use dynamic analysis to validate findings obtained during static analysis. Combining static  analysis and dynamic analysis helps you gain a better understanding of the malware binary. Basic dynamic analysis has its limitations, and to gain a deeper insight into the workings of the malware binary, you will have to perform code analysis (reverse engineering).

For example, most malware samples used in this chapter used encrypted communication to communicate with their C2 server. Using dynamic analysis, we were only able to determine the encrypted communication, but to understand how the malware is encrypting the traffic and what data it is encrypting, you need to learn how to perform code analysis.

In the next few chapters, you will learn the basics, tools, and techniques to perform code analysis.