Unit 6: Analysis of Malware - Subjective Questions

Malware, or malicious software, is any program, script, document, or code intentionally designed to damage systems, disrupt operations, steal information, obtain unauthorized access, or perform actions against the interests of a user or organization.

Major characteristics of malware include:

• Malicious intent: It is created or used to perform unauthorized or harmful activities.
• Stealth: Malware may hide its files, processes, network traffic, or registry entries to avoid detection.
• Persistence: It may configure startup entries, services, scheduled tasks, or other mechanisms to survive system restarts.
• Propagation: Worms and some other malware can spread through networks, removable media, email, or software vulnerabilities.
• Payload execution: Malware may encrypt files, steal credentials, monitor users, or provide remote access.
• Evasion: It may use packing, encryption, obfuscation, anti-debugging, or sandbox-detection techniques.
• Command and control: Advanced malware often communicates with an attacker-controlled server to receive instructions or transmit stolen data.

Legitimate software operates with the user's authorization and has a declared purpose, whereas malware deliberately violates security properties such as confidentiality, integrity, and availability.

Attackers use both technical weaknesses and human behavior to distribute malware. Common techniques include:

• Phishing emails: Messages contain malicious attachments or links and persuade users to open them.
• Malicious documents: Word, Excel, or PDF files may contain macros, scripts, exploits, or links that download malware.
• Drive-by downloads: Visiting a compromised or malicious website causes malware to be downloaded through browser vulnerabilities.
• Malvertising: Harmful advertisements redirect users to exploit kits or fraudulent download pages.
• Software vulnerabilities: Attackers exploit unpatched operating systems, applications, or network services.
• Trojanized software: Malware is disguised as a legitimate application, game, update, or cracked program.
• Supply-chain attacks: A trusted software vendor, update mechanism, or dependency is compromised.
• Removable media: Infected USB devices may spread malware through malicious shortcuts or executable files.
• Network propagation: Worms scan for vulnerable systems and spread automatically.
• Compromised credentials: Attackers use stolen credentials to log in remotely and install malware.

Effective defense requires user awareness, patch management, email filtering, endpoint protection, application control, and network monitoring.

A malware campaign may combine several delivery methods into a single infection chain:

1. Target selection: The attacker gathers information about an individual or organization.
2. Social engineering: A believable pretext is created, such as an invoice, job offer, security warning, or delivery notice.
3. Phishing delivery: The victim receives an email or message containing a malicious attachment or link.
4. Redirection: The link may lead to a compromised website, fake login page, or attacker-controlled landing page.
5. Drive-by download: The page checks the browser and plugins for vulnerabilities and attempts to download malware automatically.
6. User-assisted execution: If automatic exploitation fails, the page may persuade the user to install a fake update or enable document macros.
7. Payload installation: A downloader installs ransomware, spyware, a remote-access Trojan, or another payload.
8. Persistence and command-and-control communication: The malware establishes persistence and connects to an attacker-controlled server.

This combination is effective because social engineering creates trust, phishing provides targeted delivery, and drive-by techniques exploit technical weaknesses with minimal user interaction.

Malware forensics is the systematic identification, preservation, examination, and interpretation of evidence associated with malicious software.

Major stages include:

1. Preparation: Establish authorization, forensic tools, isolated laboratories, and evidence-handling procedures.
2. Identification: Locate suspicious files, processes, documents, memory regions, network traffic, and persistence mechanisms.
3. Containment: Isolate affected systems while avoiding unnecessary changes to volatile evidence.
4. Preservation: Capture memory, disk images, packet data, and relevant logs using forensically sound methods.
5. Integrity verification: Calculate cryptographic hashes such as SHA-256 before and after copying evidence.
6. Static examination: Inspect file structure, strings, metadata, imports, embedded resources, and document objects without executing the sample.
7. Dynamic examination: Execute the malware in a controlled environment and observe system and network behavior.
8. Correlation: Relate host artifacts, network events, timestamps, and threat intelligence to reconstruct the incident.
9. Reporting: Document methods, findings, indicators of compromise, limitations, and conclusions.

A proper investigation must maintain a chain of custody, preserve original evidence, use repeatable procedures, and clearly distinguish observed facts from analyst interpretations.

Static analysis examines malware without executing it.

• Studies hashes, file headers, strings, imported functions, metadata, and embedded resources.
• Is relatively safe and repeatable.
• May be limited by packing, encryption, or obfuscation.

Dynamic analysis executes malware in an isolated environment.

• Observes processes, files, registry changes, memory activity, persistence, and network traffic.
• Reveals actual runtime behavior and unpacked code.
• May miss delayed or condition-dependent behavior, and it involves containment risks.

Hybrid analysis combines static and dynamic techniques.

• Static findings guide runtime monitoring.
• Dynamic analysis exposes decoded configuration, injected code, and network indicators.
• Post-execution static analysis can then examine dumped or unpacked components.

Hybrid analysis generally provides the most complete result because it combines structural evidence with observed behavior.

A systematic static analysis workflow can be performed as follows:

1. Preserve the sample: Work on a copy, record its source, and calculate hashes such as MD5, SHA-1, and SHA-256.
2. Identify the file type: Verify its actual format using magic bytes rather than trusting the file extension.
3. Check reputation carefully: Compare the hash with authorized internal or external threat-intelligence sources without uploading sensitive samples improperly.
4. Inspect headers: Examine architecture, compilation information, entry point, sections, permissions, and anomalies.
5. Extract strings: Search for URLs, IP addresses, filenames, commands, registry references, mutex names, and error messages.
6. Review imports and exports: Imported APIs may indicate file manipulation, networking, process injection, cryptography, or persistence.
7. Analyze sections and entropy: Unusual section names, executable writable sections, or high entropy may indicate packing or encryption.
8. Inspect resources: Look for embedded executables, configuration files, icons, certificates, and encrypted payloads.
9. Disassemble or decompile: Study control flow and important functions when deeper analysis is required.
10. Document indicators and hypotheses: Record findings, confidence levels, tool versions, and limitations for later validation through dynamic analysis.

The sample must not be opened or executed on a normal production workstation.

These artifacts provide complementary information about a suspicious file:

• Hashes: Cryptographic hashes uniquely identify a known file version, support evidence-integrity verification, and allow reputation correlation. A changed byte produces a different cryptographic hash, so hashes do not identify modified variants reliably.
• Strings: Human-readable or encoded strings may reveal domains, IP addresses, file paths, commands, credentials, mutexes, and error messages. Attackers may encrypt or construct strings at runtime.
• Imports: Imported functions indicate possible capabilities. Networking APIs suggest communication, process APIs may indicate injection, and registry APIs may indicate persistence.
• File headers: Headers reveal the file format, architecture, entry point, sections, timestamps, and required libraries. Inconsistent or malformed values can indicate manipulation.
• Entropy: Entropy estimates the randomness of data. High entropy may indicate encryption, compression, or packing. For byte data, Shannon entropy can be represented as:

A value close to 8 bits per byte suggests highly random or compressed content, but it does not by itself prove maliciousness. Findings must therefore be correlated rather than interpreted in isolation.

Packing compresses or encrypts an executable and includes a small unpacking routine that restores the original code during execution. Obfuscation transforms code, strings, or control flow so that the program remains functional but becomes difficult to understand.

Effects on static analysis:

• Original instructions and strings may not be visible.
• Imports may be hidden or resolved dynamically.
• Disassembly may contain misleading code or abnormal control flow.
• Signature-based detection becomes less reliable.
• Multiple malware samples may appear different even when they perform the same behavior.

Indicators include:

• High-entropy sections.
• Very few imported functions.
• Unusual section names or permissions.
• An entry point located in an abnormal section.
• Large differences between raw and virtual section sizes.
• Runtime calls that allocate memory, change memory permissions, or resolve APIs dynamically.
• Known packer signatures.

Analysts can use controlled dynamic execution, memory dumping, debugger-assisted unpacking, or specialized unpacking tools. After the original code is recovered from memory, it should be hashed and analyzed again using static techniques.

A suspicious Word document should be analyzed without opening it normally on a production system.

Recommended procedure:

1. Preserve and hash the file: Record its origin, timestamps, and SHA-256 hash.
2. Identify the format: Determine whether it is an older OLE compound file or a modern Office Open XML archive.
3. Inspect metadata: Review author information, template names, creation times, application versions, and revision data.
4. Enumerate embedded content: Search for macros, OLE objects, executables, scripts, external relationships, and embedded documents.
5. Analyze macros: Extract Visual Basic for Applications code and look for automatic execution functions, obfuscated strings, shell commands, downloads, or PowerShell use.
6. Check external mechanisms: Examine DDE fields, remote templates, hyperlinks, and external image or object references.
7. Decode content: Deobfuscate encoded commands and reconstruct URLs or scripts without executing them.
8. Perform controlled dynamic analysis: If authorized, open the document in an isolated virtual machine while monitoring process, file, registry, and network activity.

Warning signs include requests to enable content, macros that launch command interpreters, child processes created by Word, and connections to unfamiliar domains.

A PDF consists of objects that may contain text, streams, scripts, actions, forms, and embedded files. Important elements include:

• Document catalog and page objects: These define the main structure and may reference automatic actions.
• JavaScript objects: Embedded JavaScript may perform redirection, exploit attempts, or data collection.
• Automatic actions: Entries such as OpenAction or additional actions can trigger code when the document is opened or viewed.
• Embedded files: Executables, Office documents, archives, or scripts may be hidden inside the PDF.
• Launch actions: These may attempt to start external programs or open files.
• URI actions: Suspicious links may direct users to phishing pages or malware downloads.
• Forms and annotations: Interactive objects can contain scripts or hidden links.
• Encoded streams: Compressed or obfuscated streams should be extracted and decoded.
• Metadata: Author, producer, creation date, and editing software may provide attribution or timeline clues.
• Structural anomalies: Damaged cross-reference tables, repeated updates, and unusual object counts may indicate manipulation.

The analyst should parse and extract objects using dedicated PDF-analysis tools, search for suspicious keywords, decode streams, and only use dynamic opening inside an isolated environment.

Word and PDF documents can both deliver malware, but their internal structures and execution mechanisms differ.

Similarities:

• Both may contain scripts, embedded files, hyperlinks, exploits, and obfuscated content.
• Both should be hashed, preserved, and examined without normal opening.
• Metadata, external references, and embedded objects are important sources of evidence.
• Dynamic analysis should be performed only in an isolated environment.

Word-specific features:

• VBA macros and automatic macro functions.
• OLE embedded objects.
• DDE fields and external templates.
• Office Open XML relationships.
• Child processes such as command interpreters or scripting engines launched by Word.

PDF-specific features:

• PDF objects, streams, cross-reference tables, and trailers.
• Embedded JavaScript.
• OpenAction, Launch, URI, form, and annotation actions.
• Encoded streams and embedded attachments.
• Exploits targeting PDF reader vulnerabilities.

The core forensic principles are the same, but analysts require format-specific parsers and must understand the distinct mechanisms through which each document type triggers malicious behavior.

Dynamic malware analysis involves executing a suspicious sample in a controlled environment and observing its runtime behavior.

Fundamental objectives include:

• Identifying created or modified files.
• Observing processes, threads, services, and injected code.
• Monitoring registry and configuration changes.
• Detecting persistence mechanisms.
• Capturing DNS requests and network connections.
• Extracting runtime configuration, decrypted strings, or unpacked payloads.

A safe laboratory should include:

• Isolation: The analysis network must be separated from production systems.
• Virtual machines or dedicated hosts: Clean snapshots should allow repeatable testing and rapid restoration.
• Controlled networking: Simulated services, sinkholes, or restricted gateways can be used instead of unrestricted internet access.
• Monitoring tools: Process, file, registry, memory, and packet-capture tools should be active before execution.
• No shared resources: Shared folders, clipboards, removable media, and host integration should be disabled where possible.
• Realistic configuration: The system should contain realistic applications and activity when malware checks for artificial environments.
• Time synchronization and logging: Accurate timestamps are essential for event correlation.

Dynamic analysis carries risk because malware may escape, propagate, destroy evidence, or detect the laboratory. Strong containment and documented authorization are therefore essential.

Automated sandboxing executes a sample automatically and produces a behavioral report.

• Advantages: Fast, scalable, consistent, and suitable for initial triage.
• Limitations: May miss behavior requiring user interaction, special arguments, long delays, or specific environmental conditions.

Manual behavioral analysis involves an analyst interacting with the malware in a monitored laboratory.

• Advantages: The analyst can test different inputs, trigger hidden features, compare multiple executions, and interpret context.
• Limitations: It is time-consuming, requires expertise, and may produce inconsistent results if procedures are not documented.

Debugger-assisted analysis executes the sample under controlled instruction-level observation.

• Advantages: It can reveal control flow, decryption routines, anti-analysis checks, unpacking behavior, and memory-resident payloads.
• Limitations: It requires advanced knowledge and can be defeated by anti-debugging methods.

A practical investigation often begins with automated sandboxing, continues with manual monitoring, and uses a debugger only for difficult routines or concealed behavior. Findings from all approaches should be correlated with static evidence.

Real-time host analysis monitors the changes malware makes while it is running. The analyst should first capture a clean baseline and then compare it with activity after execution.

Properties to monitor include:

• Processes and threads: New processes, unusual parent-child relationships, process injection, and terminated security tools.
• File-system activity: Created, modified, renamed, deleted, or encrypted files and dropped payloads.
• Registry and configuration changes: Startup entries, policy changes, application settings, and security modifications.
• Services and drivers: Newly installed services, kernel drivers, and changes to service configurations.
• Persistence mechanisms: Scheduled tasks, startup folders, login scripts, event subscriptions, and modified shortcuts.
• Memory activity: Executable private memory, injected modules, decoded configurations, and credential-related access.
• User and security properties: New accounts, privilege changes, firewall modifications, and disabled defenses.

Events must be timestamped and arranged into a timeline. Analysts should record both the attempted and successful operations, because failed actions may still reveal malware objectives and required privileges.

Real-time monitoring reveals security-relevant operations as they occur:

Persistence:

• Creation of startup registry values or startup-folder items.
• Installation of services or scheduled tasks.
• Modification of login scripts, shortcuts, browser extensions, or system event subscriptions.
• Replacement or patching of frequently executed legitimate files.

Privilege escalation:

• Access to sensitive system processes or security tokens.
• Attempts to exploit a local vulnerability.
• Creation of elevated services or tasks.
• Changes to access-control settings, user groups, or security policies.
• Bypasses that cause a trusted elevated process to execute attacker-controlled content.

Process injection:

• Opening another process with extensive permissions.
• Allocating and writing memory in a remote process.
• Changing memory to executable permissions.
• Creating remote threads or manipulating an existing thread.
• Unusual code executing from private memory rather than a normal loaded module.

An analyst should correlate API activity, process trees, memory maps, event logs, and file or registry changes. A single event may be legitimate, but a sequence such as memory allocation, remote writing, permission change, and remote execution strongly suggests injection.

Real-time network analysis identifies how malware discovers infrastructure, communicates with attackers, downloads payloads, and exfiltrates data.

Procedure:

1. Prepare controlled networking: Use an isolated network with simulated services, a sinkhole, or a restricted gateway.
2. Start packet capture and logging: Capture packets and collect DNS, proxy, firewall, and flow records before executing the sample.
3. Run the malware: Record the exact start time and all user interactions.
4. Observe DNS behavior: Identify queried domains, failed lookups, rapidly changing names, or algorithmically generated domains.
5. Inspect connections: Record destination IP addresses, ports, protocols, timing, and connection frequency.
6. Analyze application traffic: Examine HTTP requests, headers, user agents, cookies, payloads, and response content where legally and technically possible.
7. Examine encrypted traffic: Use metadata such as certificates, server names, packet sizes, timing, and flow patterns when content cannot be decrypted.
8. Identify command and control: Look for periodic beaconing, encoded commands, fallback servers, and task-response patterns.
9. Detect exfiltration: Search for unusual outbound volume, encoded data, archive transfers, or unexpected protocols.
10. Correlate with host events: Link each connection to the responsible process and related file or registry activity.

The result should include validated network indicators and an explanation of their behavioral context.

Command-and-control indicators include:

• Periodic connections at fixed or nearly fixed intervals, known as beaconing.
• Connections to rare, newly registered, or low-reputation domains.
• Many failed DNS requests or algorithmically generated domain names.
• Communication over unusual ports or unexpected protocols.
• Repeated small requests followed by short encoded responses.
• Suspicious HTTP user agents, headers, URL patterns, or encrypted parameters.
• Direct connections to IP addresses without normal domain resolution.
• Unusual digital certificates or inconsistent TLS characteristics.

Data-exfiltration indicators include:

• Large outbound transfers from a host that normally sends little data.
• Encoded or compressed content sent to unfamiliar destinations.
• Long DNS labels or unusually frequent DNS queries, which may indicate tunneling.
• Uploads during unusual hours.
• Repeated transfer of similarly sized chunks.
• Unexpected use of cloud storage, web forms, email, or file-transfer protocols.

No single indicator proves maliciousness. Analysts should compare activity with the organization's baseline and correlate network events with the process, user, file access, and incident timeline.

Correlation combines separate artifacts into a chronological explanation of the incident.

Relevant host evidence includes:

• File creation and modification timestamps.
• Process start and termination events.
• Parent-child process relationships.
• Registry, service, and scheduled-task changes.
• Memory findings and security logs.
• User login and privilege events.

Relevant network evidence includes:

• DNS queries and responses.
• Connection start and end times.
• Proxy, firewall, and packet-capture records.
• Downloaded payloads and outbound transfers.
• Destination domains, IP addresses, ports, and certificates.

Correlation process:

1. Normalize timestamps to a common time zone and account for clock drift.
2. Identify the initial delivery event, such as opening a document.
3. Link the document process to a spawned script interpreter or executable.
4. Match file creation with subsequent process execution.
5. Connect the responsible process to DNS queries and outbound sessions.
6. Identify persistence and privilege changes following execution.
7. Relate file access or archive creation to later outbound transfers.
8. Assign confidence levels and identify gaps in the evidence.

The final timeline should separate verified observations from inferences and explain the complete sequence from initial access to persistence, command and control, and possible exfiltration.

Malware uses anti-analysis techniques to hide behavior or delay investigation.

Common techniques include:

• Packing and encryption: Conceal code and configuration until runtime.
• Anti-debugging: Detect breakpoints, debugger processes, timing changes, or debugging flags.
• Virtual-machine detection: Check hardware identifiers, drivers, processes, memory size, or other signs of virtualization.
• Sandbox detection: Look for low user activity, short execution times, unrealistic files, or missing applications.
• Delayed execution: Sleep for long periods or wait for a specific date or event.
• Environmental checks: Execute only for a particular language, domain, username, argument, or network condition.
• Code obfuscation: Use misleading control flow, dynamically resolved functions, or encoded strings.
• Security-tool interference: Terminate monitoring tools or alter logging settings.

Analyst responses include:

• Making the laboratory appear realistic.
• Extending monitoring time and simulating user interaction.
• Patching or bypassing environment checks under controlled conditions.
• Using multiple analysis environments and tools.
• Dumping unpacked code from memory.
• Comparing executions under different configurations.
• Combining static, dynamic, memory, and network evidence.

All modifications made to trigger behavior must be documented so that the analysis remains repeatable.

Fileless malware is malicious activity that primarily uses memory, trusted system utilities, scripts, configuration stores, or remote content instead of placing a conventional malicious executable on disk. The term does not always mean that no disk artifacts exist; logs, scripts, shortcuts, registry data, or temporary content may still remain.

Typical attack chain:

1. Initial access: A victim opens a phishing document, follows a malicious link, or exposes a vulnerable service.
2. Script execution: A macro or exploit launches a trusted scripting engine or system utility.
3. Remote retrieval: Encoded commands retrieve malicious code from a remote server or configuration location.
4. Memory execution: The payload is decoded and executed directly in memory.
5. Living-off-the-land activity: Legitimate administrative utilities are abused for discovery, credential access, movement, or execution.
6. Persistence: The attacker may use scheduled tasks, registry-based commands, event subscriptions, startup scripts, or compromised accounts.
7. Command and control: Memory-resident code contacts attacker infrastructure to receive instructions.
8. Objective completion: Data is stolen, credentials are captured, systems are disrupted, or additional payloads are deployed.

Fileless attacks evade simple file-scanning controls because many actions occur through trusted processes. Behavioral monitoring, script logging, memory analysis, and process-tree investigation are therefore essential.