It’s Not Just the Code Sweating on the Analysis Table: First Steps into the Malware World

If you're seeing 0xEB (JMP) instead of 0x90 (NOP) at the first breakpoint you hit, that malware has already invited you down a deep rabbit hole. In that moment, you realize you're not just looking at a pile of code; you're dealing with the product of a mindset playing a game of chess against you.

Hey everyone, today we're going to get our hands a little dirty. While we design penetration scenarios on the Red Team side and sometimes write our own 'creatures,' opening that black box left behind by someone else and figuring out what's inside is a completely different art form on the Defensive side. Malware analysis is the autopsy table of cybersecurity. The patient on the table is usually alive, awake, and looking for a chance to take you down with it.

First Contact: The Silent Power of Static Analysis

Before we just toss a file into a sandbox and say, 'Let's see what it does,' we need to introduce ourselves like gentlemen. Static analysis is the art of gathering information about a file without actually running it. You've taken the file's hash (MD5, SHA256) and checked VirusTotal—okay, fine. But that's just the 'magazine gossip' part of the job. Real analysis begins when you catch an IP address or an API call hidden within those meaningless characters in the strings output.

For example, let’s assume we found a suspicious .exe on a server within 'testCompany.' The first thing we do is check the entropy value. If a file’s entropy is over 7.0, you can bet it’s either packed or encrypted. Basically, the attacker is trying to hide the content from us.

# Defanged strings example
$ strings suspect_file.exe | grep -E "(http|https)://"
# Output might look something like this:
# http[:]//update.example[.]com/api/v1/collect
# User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

This http[:]//update.example[.]com address is our first candidate for an IOC (Indicator of Compromise). Examining PE (Portable Executable) headers and seeing which libraries (DLLs) are imported tells us the file's intent. If a calculator app is importing ws2_32.dll (a network library), that calculator probably isn't just doing addition and subtraction.

Dynamic Analysis: Waking the Beast in the Lab

Dynamic analysis involves running the file in a controlled environment (an isolated VM) and monitoring its behavior. Rule number one: Never bridge the connection with your host machine. Host-only networking saves lives every time.

When we run the file, we use tools like Process Monitor (ProcMon) or Wireshark to observe how it manipulates the system. Malware usually tries to achieve three things:

1. Persistence: Embedding itself into Registry keys or the Startup folder to run again after a reboot.
2. C2 (Command and Control) Communication: Telling the attacker's server, 'I'm here, awaiting orders.'
3. Exfiltration: Packing up sensitive files and shipping them out.

# Logic of a malware adding itself to the registry (Pseudo-code)
import winreg

def gain_persistence():
    # Registry path for startup
    path = r"Software\Microsoft\Windows\CurrentVersion\Run"
    # Example logic to add a key to maintain persistence
    # This is a common technique used by malware to stay alive
    print("Persistence logic triggered for education purposes...")
    pass