Malware Analysis

Malware Analysis: Static Analysis

FLOSS:

Extract obfuscated strings from a malware binary:
$ floss [C:\path\to\File.extension]

Only extract stack and tight strings:
$ floss --only stack tight -- [C:\path\to\File.extension]

Do not extract static strings:
$ floss --no static -- [C:\path\to\File.extension]

Display the help/usage screens:
$ floss -h  # show core arguments
$ floss -H  # show all supported arguments


CAPA:

Run Capa with double verbose(Remove "v" for less information:
capa [C:\path\to\File.extension] -vv


Malware Analysis: Dynamic Analysis:

Example Indicators:

Host Indicators		and		Network Indicators

Delete File				Calls out to domain
Installs Persistence			Downloads a File


Template Static Analysis:

Filename:
File Hash: i.e MD5 and SHA256
File Hash Lookup: i.e. virus Total
Basic String Analysis: i.e. Floss, PeStudio & CAPA

Template Dynamic/Heuristic/Behavioral Analysis:

Wireshark:
Setup Remnux and Wireshark and Kick off the malware and use the strings from the basic analysis to narrow down on indicators.