Malware analysis basics in Cybersecurity - Mini Project: Build & Apply

Malware Analysis Basics

📖 Scenario: You are a cybersecurity analyst tasked with understanding basic malware characteristics to help protect your company's network. You will create a simple data structure to represent malware samples and analyze their properties step-by-step.

🎯 Goal: Build a structured overview of malware samples with their types and behaviors, then filter and summarize this data to understand common malware traits.

📋 What You'll Learn

Create a dictionary named malware_samples with exact malware names and their types

Add a variable high_risk_types listing malware types considered high risk

Use a dictionary comprehension to create high_risk_samples containing only malware of high risk types

Add a final summary variable summary that counts how many high risk samples were found

💡 Why This Matters

🌍 Real World

Cybersecurity analysts often need to organize and analyze malware data to understand threats and protect networks.

💼 Career

This project teaches foundational skills in data organization and filtering, which are essential for malware analysis and threat intelligence roles.

1

Create the malware samples dictionary

Create a dictionary called malware_samples with these exact entries: 'TrojanX': 'Trojan', 'WormY': 'Worm', 'SpyZ': 'Spyware', 'AdwareA': 'Adware', 'RansomB': 'Ransomware'

Cybersecurity

# Create the malware_samples dictionary with given entries
# Your code here

Hint

Use curly braces {} to create a dictionary with the exact malware names as keys and their types as values.

2

Define high risk malware types

Create a list called high_risk_types containing these exact strings: 'Trojan', 'Ransomware', and 'Worm'

Cybersecurity

malware_samples = {
    'TrojanX': 'Trojan',
    'WormY': 'Worm',
    'SpyZ': 'Spyware',
    'AdwareA': 'Adware',
    'RansomB': 'Ransomware'
}
# Create the high_risk_types list with given malware types
# Your code here

Hint

Use square brackets [] to create a list with the exact malware types as strings.

3

Filter high risk malware samples

Use a dictionary comprehension to create a dictionary called high_risk_samples that includes only the entries from malware_samples where the malware type is in high_risk_types

Cybersecurity

malware_samples = {
    'TrojanX': 'Trojan',
    'WormY': 'Worm',
    'SpyZ': 'Spyware',
    'AdwareA': 'Adware',
    'RansomB': 'Ransomware'
}
high_risk_types = ['Trojan', 'Ransomware', 'Worm']
# Create high_risk_samples dictionary using comprehension
# Your code here

Hint

Use {name: mtype for name, mtype in malware_samples.items() if mtype in high_risk_types} to filter the dictionary.

4

Summarize high risk malware count

Create a variable called summary and set it to a string that says exactly: "Number of high risk malware samples: X" where X is the number of items in high_risk_samples

Cybersecurity

malware_samples = {
    'TrojanX': 'Trojan',
    'WormY': 'Worm',
    'SpyZ': 'Spyware',
    'AdwareA': 'Adware',
    'RansomB': 'Ransomware'
}
high_risk_types = ['Trojan', 'Ransomware', 'Worm']
high_risk_samples = {name: mtype for name, mtype in malware_samples.items() if mtype in high_risk_types}
# Create summary string with count of high risk samples
# Your code here

Hint

Use an f-string to include the length of high_risk_samples in the summary string.

Practice

1. What is the main purpose of malware analysis?

easy

A. To understand and identify harmful software

B. To create new software applications

C. To speed up computer performance

D. To backup important files

Solution

1. Step 1: Understand the goal of malware analysis

   Malware analysis is done to study harmful software to know how it works and how to stop it.

2. Step 2: Compare options with the goal

   Only To understand and identify harmful software matches this goal. Other options relate to different computer tasks.

3. Final Answer:

   To understand and identify harmful software -> Option A

4. Quick Check:

   Malware analysis = Understand harmful software [OK]

Hint: Focus on understanding malware's purpose [OK]

Common Mistakes:

• Confusing malware analysis with software development
• Thinking malware analysis improves computer speed
• Mixing malware analysis with file backup tasks

2. Which method is used in static malware analysis?

easy

A. Running the malware in a safe environment

B. Deleting the malware immediately

C. Monitoring network traffic during infection

D. Examining the malware code without executing it

Solution

1. Step 1: Define static analysis

   Static analysis means studying malware without running it, usually by looking at its code or files.

2. Step 2: Match options to static analysis

   Examining the malware code without executing it describes examining code without execution, which is static analysis. Other options involve running or removing malware.

3. Final Answer:

   Examining the malware code without executing it -> Option D

4. Quick Check:

   Static analysis = Code examination without running [OK]

Hint: Static means no running, just code study [OK]

Common Mistakes:

• Confusing static with dynamic analysis
• Thinking static analysis involves running malware
• Assuming deleting malware is analysis

3. Consider this code snippet used in dynamic malware analysis:

log = []
for action in ['open_file', 'modify_registry', 'send_data']:
    log.append(f"Action: {action}")
print(log)

What will be the output?

medium

A. ['open_file', 'modify_registry', 'send_data']

B. Action: open_file
Action: modify_registry
Action: send_data

C. ['Action: open_file', 'Action: modify_registry', 'Action: send_data']

D. Error: log is not defined

Solution

1. Step 1: Understand the loop and append operation

   The loop goes through each action and appends a string with 'Action: ' plus the action name to the list log.

2. Step 2: Determine the final list content

   After the loop, log contains three strings: 'Action: open_file', 'Action: modify_registry', and 'Action: send_data'. Printing log shows this list.

3. Final Answer:

   ['Action: open_file', 'Action: modify_registry', 'Action: send_data'] -> Option C

4. Quick Check:

   Loop appends formatted strings = list with 'Action: ...' [OK]

Hint: Look for string formatting inside loop append [OK]

Common Mistakes:

• Ignoring the 'Action: ' prefix in strings
• Confusing list print with separate print lines
• Assuming a runtime error without reason

4. A malware analyst wrote this code to check if a file is malicious:

def is_malicious(file):
    if file.endswith('.exe') or '.dll':
        return True
    else:
        return False

What is the error in this code?

medium

A. The condition always returns True because of incorrect or usage

B. The function does not return any value

C. The file variable is not defined

D. The function should use 'and' instead of 'or'

Solution

1. Step 1: Analyze the condition in the if statement

   The condition is 'file.endswith('.exe') or '.dll''. The second part '.dll' is a non-empty string, which is always True in Python.

2. Step 2: Understand the effect of the condition

   Because '.dll' is always True, the whole condition always evaluates to True, so the function always returns True regardless of the file extension.

3. Final Answer:

   The condition always returns True because of incorrect or usage -> Option A

4. Quick Check:

   Non-empty string in or condition = always True [OK]

Hint: Check if all parts of 'or' are boolean expressions [OK]

Common Mistakes:

• Thinking the function never returns True
• Assuming file variable is undefined
• Believing 'and' fixes the logic without changing condition

5. You want to create a dictionary summarizing malware actions and their counts from this list:

actions = ['open_file', 'send_data', 'open_file', 'modify_registry', 'send_data', 'send_data']

Which dictionary comprehension correctly counts each action?

hard

A. {action: actions.index(action) for action in actions}

B. {action: actions.count(action) for action in set(actions)}

C. {actions.count(action): action for action in actions}

D. {action: len(action) for action in actions}

Solution

1. Step 1: Understand the goal of counting actions

   We want a dictionary where keys are unique actions and values are how many times each appears.

2. Step 2: Analyze each option

   {action: actions.count(action) for action in set(actions)} uses set(actions) to get unique actions and counts each correctly. {action: actions.index(action) for action in actions} uses index which gives first position, not count. {actions.count(action): action for action in actions} reverses keys and values incorrectly. {action: len(action) for action in actions} counts string length, not occurrences.

3. Final Answer:

   {action: actions.count(action) for action in set(actions)} -> Option B

4. Quick Check:

   Use set for unique keys and count for values [OK]

Hint: Use set() for unique keys and count() for values [OK]

Common Mistakes:

• Using list instead of set for keys causing duplicates
• Using index instead of count for frequency
• Mixing keys and values in comprehension