It was 3:15 AM. I woke up to that infamous, gut-wrenching 'high severity' notification sound. An accounting PC on the testCompany network was sending weird, periodic packets to an IP address it should never be visiting (simulated via 127.0.0.1 as a C2 server). EDR (Endpoint Detection and Response) caught something, but it couldn't quite tell us what we were dealing with yet. When I fired up my laptop, the culprit was staring right at me: invoice_9928.pdf.exe. A classic move, yet frustratingly effective even today. That was the moment I knew it was time to open this 'black box.'
Malware analysis is essentially a digital autopsy. But during this autopsy, the 'corpse' can jump up and bite you at any second. That’s why our first rule is always an isolated environment. In my own lab (sandbox), on a virtual machine with no internet access and where every movement is logged, I laid the file out on the table.
Static Analysis: Not Love at First Sight, But Suspicion
Before running the file, we need to look at it from the outside. Static analysis is the examination performed without actually executing the code. The first thing I did was grab the file's hash (SHA-256) and search for it in known databases. The result? Completely clean. This means we're looking at 'FUD' (Fully Undetectable)—a malware whose signature isn't recognized yet, perhaps even custom-made for testCompany.
Next, I checked the readable characters inside the file using the strings command. If the attacker is an amateur, you'll find C2 addresses, error messages, or libraries they used right there. But our friend here was a bit more professional; the output was just a meaningless jumble of characters. This is the first big red flag indicating the file is 'packed' or 'obfuscated.'
Peeking at the headers of a PE (Portable Executable) file whispers what the file intends to do. For instance, if it's importing API functions like VirtualAlloc, WriteProcessMemory, and CreateRemoteThread, this guy is likely trying to perform 'Process Injection.' In other words, it's going to hide itself inside an innocent process (like explorer.exe).
Dynamic Analysis: Opening the Box
In dynamic analysis, we run the file and monitor the changes it makes to the system. Procmon (Process Monitor) and Wireshark (in a defanged environment) are our best friends here. The moment I executed the file, the first thing it did was carve out a spot for itself in the Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
It added a randomly named key under this path. This is a 'Persistence' technique; it ensures the malware runs automatically every time the computer reboots.
Then I saw this fake connection request:
HTTP GET http://example.com/api/v1/config (The real address was different, but let's keep it defanged).
Code Analysis and Reverse Engineering: Nesting Dolls
This is the most enjoyable but exhausting part. Opening the file in a decompiler or disassembler (like IDA Pro or Ghidra) allows us to peel back the layers like a Matryoshka doll to see the actual logic hidden beneath the obfuscation.