Malware Analysis Fundamentals

What Malware Analysis Is and Why Analysts Need It

• Malware analysis is the systematic examination of a suspicious file or URL to determine if it is malicious, how it operates, and what its objective is.
• MITRE ATT&CK maps user execution of malicious payloads to T1204 (User Execution), and the defense falls under M1049 (Antivirus/Antimalware) and M1040 (Behavioral Prevention).
• Analysts who understand malware analysis can distinguish between a confirmed threat and a false positive, triage samples quickly to determine response priority, and extract indicators (IOCs) for detection and blocking.
• The discipline has two major branches: static analysis (examining the file without executing it) and dynamic analysis (running the file and observing its behavior).

Static Analysis — Examining the File Without Execution

Static analysis extracts information from the file itself without running it. It is the fastest and safest analysis method.

Hash Types — The First Check

Every file has a cryptographic hash — a fingerprint that uniquely identifies it. Analysts use three hash algorithms:

When to use which:

• SHA256 — Primary hash for detection rules, VirusTotal lookups, and IOC sharing (MISP, STIX)
• MD5 — Useful when searching legacy intel feeds or de-duplicating in large file collections
• SHA1 — Rarely used today; some older security tools still reference it

File Metadata Examination

Before running any tools, read the file’s metadata:

# Linux — get file type and basic info
file suspicious.exe
# PE32 executable (GUI) Intel 80386, for MS Windows

# Extract PE metadata with exiftool
exiftool suspicious.exe

# Windows — check the digital signature
sigcheck.exe -a suspicious.exe

Section Analysis — Spotting Packers

PE executables are divided into sections. Packed malware uses non-standard sections or incorrectly sized ones:

Entropy check with spark or sigcheck:

# Check section entropy with sigcheck (Windows)
sigcheck.exe -e suspicious.exe

# CLI entropy scanner on Linux
cat suspicious.exe | ent

A Shannon entropy above 7.5 in the .text section strongly indicates packed or encrypted code.

Packers — Why Malware Packs Itself

Packers compress or encrypt the original executable and wrap it in a small stub that unpacks the real code in memory. Malware authors use packers to evade signature-based detection.

Common Packers

Unpacking Workflow

1. Simple packing (UPX, MPRESS): Use the unpacker tools above
2. Custom packer: Run the malware in a sandbox, let it unpack in memory, then dump the process memory
3. Dump unpacked process memory:

   # Use Process Hacker (Windows) to dump process memory
   # Or use LiME (Linux Memory Extractor) on a live Linux sandbox
   # Or use Volatility to dump the process:
   vol -f memory.dump windows.memmap.Memmap --pid 1234 --dump

Dynamic Analysis — Running Malware in a Sandbox

Dynamic analysis executes the file in a controlled environment and records everything it does. This is the most reliable way to understand malware behavior.

Sandbox Requirements

What to Observe

Sandbox Evasion Techniques

Malware authors actively detect sandbox environments and alter behavior:

Quick evasion check — Sysmon Event ID 1 for sleep commands:

index=windows sourcetype=WinEventLog:Sysmon EventCode=1
| search CommandLine="*sleep*" OR CommandLine="*Start-Sleep*" OR CommandLine="*timeout*"
| stats count, values(CommandLine) as Commands by Image, Computer
| where count > 3
| eval alert = "Potential sandbox evasion — " . Image . " called sleep multiple times: " . Commands
| table Computer, Image, count, alert

Analyst Triage Workflow

5-Minute Checklist

Triage Decision Matrix

Tools Every Analyst Should Know

Related

• Malware Analysis Triage — detection and response for T1204 techniques
• EDR Basics — detection and response for T1059, T1003, T1055, T1204, T1562 techniques
• Kill Chain — covers the kill chain concepts
• Ghidra — detection and response for T1204 techniques
• REMnux — detection and response for T1204 techniques

Sources

• VirusTotal
• Any.Run Interactive Sandbox
• FLARE VM Analysis Environment
• Ghidra Reverse Engineering Framework
• PEStudio
• CAPA — Malware Capability Identification
• MITRE ATT&CK — T1204 User Execution