Malware Analysis – Static & Dynamic (Complete Guide)

Lab Setup (Free)

Before touching a malicious file, you need a safe environment.

• REMnux (Linux): A free Linux toolkit for malware analysts. Import the OVA into VirtualBox. It comes pre-installed with Ghidra, Wireshark, Volatility, and more. Download REMnux.
• Flare VM (Windows): For dynamic execution. You need a Windows VM. Mandiant provides an open-source script to turn any Windows VM into a malware analysis beast. Download Flare VM.

Phase 1: Basic Triage (5 Min)

Start by identifying the file without executing it.

# Get basic file typing and hashing (on REMnux)
file sample.exe
sha256sum sample.exe
md5sum sample.exe

# Extract printable strings. Look for URLs, IPs, and suspicious APIs (e.g., VirtualAlloc).
strings sample.exe | grep -i "http\|url\|ip\|password\|admin\|root"
strings sample.exe | grep -E "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"

Take the SHA256 hash and search for it on VirusTotal or MalwareBazaar to see if it's a known threat.

Phase 2: Static Analysis (No Execution)

Analyze the binary structure without running the code. Malware authors frequently "pack" (compress/encrypt) their executables to hide the true code.

PE (Portable Executable) Analysis

# Use peframe to detect packers and suspicious API imports
pip install peframe
peframe sample.exe

Script & Document Analysis

Not all malware is a `.exe`. Often, it's a malicious Office Macro or PowerShell script.

# Extract malicious VBA macros from Office docs using oletools
pip install oletools
olevba malicious.doc

# Analyze malicious PDF structure
pip install pdfid
pdfid malicious.pdf

Phase 3: Dynamic Analysis (Execute in Sandbox)

Now, take a snapshot of your Flare VM, disconnect the internet adapter (or route it through REMnux for logging), and detonate the malware.

Process & Network Monitoring

• Process Monitor (ProcMon): Filter by Process Name = sample.exe. Watch for new files dropping into C:\Windows\System32 or changes to Run Registry keys (Persistence).
• Wireshark: Run Wireshark before executing. Look for DNS requests to strange domains (Command & Control beacons) or large data uploads over port 443 (Exfiltration).

Automated Sandboxing

If you don't have a lab, use a free online automated sandbox.

• ANY.RUN: Interactive online sandbox.
• Cuckoo Sandbox: Open-source local sandbox automation.

Phase 4: Reverse Engineering (Ghidra & x64dbg)

Advanced analysts decompile the binary to understand the exact logic.

• Static Disassembly (Ghidra): Developed by the NSA (free/open-source). Import the `.exe`, run Auto-Analyze, and find the main entry point. Follow the call graph to find where it communicates with the C2 server.
• Dynamic Debugging (x64dbg): Run the malware step-by-step. Set breakpoints on sensitive Windows APIs like CreateProcessA or InternetOpenA. If the malware is packed, you can dump the unpacked payload from memory once it decrypts itself.

Writing YARA Rules

Once you understand the malware, write a YARA rule to detect it across your network.

# Example YARA Rule (my_rule.yar)
rule custom_ransomware {
    meta:
        description = "Detects our custom ransomware string"
        author = "Analyst"
    strings:
        $api1 = "CreateFile"
        $api2 = "CryptEncrypt"
        $str1 = "YOUR FILES ARE ENCRYPTED"
    condition:
        all of them
}

# Scan with YARA
yara my_rule.yar /target/directory

Practice Labs (Legal Malware)

Where do you get malware to analyze safely?

• MalwareBazaar: A massive repository of live malware samples (Handle with extreme care).
• theZoo: A repository of live malware maintained for educational purposes.
• EICAR Test File: A 100% safe, inert file that all antiviruses flag as malicious (great for testing rules).