Malware analysis basics in Cybersecurity - Step-by-Step Execution

Concept Flow - Malware analysis basics

Receive Suspicious File

↓

Static Analysis

↓

Dynamic Analysis

↓

Behavior Observation

↓

Report Findings

↓

Mitigation

Malware analysis starts by getting the suspicious file, then checking it without running it (static), then running it safely (dynamic), watching what it does, and finally reporting and stopping it.

Execution Sample

Cybersecurity

1. Get suspicious file
2. Check file info (size, type)
3. Scan file with antivirus
4. Run file in safe environment
5. Watch file actions
6. Write report

This sequence shows the basic steps to analyze malware from receiving to reporting.

Analysis Table

Step	Action	What Happens	Result
1	Receive Suspicious File	File is obtained for analysis	File ready for checking
2	Static Analysis	Check file properties without running	Identify file type, hashes, strings
3	Scan with Antivirus	Run antivirus scan on file	Detect known malware signatures or none
4	Dynamic Analysis	Run file in isolated environment	Observe real-time behavior safely
5	Behavior Observation	Monitor file actions (network, files)	Record suspicious activities
6	Report Findings	Summarize analysis results	Create report for response team
7	Mitigation	Apply fixes or blocks based on report	Prevent malware spread or damage

💡 Analysis ends after reporting and mitigation steps to protect systems.

State Tracker

Variable	Start	After Step 2	After Step 4	After Step 6	Final
File Status	Suspicious	Analyzed statically	Analyzed dynamically	Behavior recorded	Mitigated or flagged
Threat Level	Unknown	Potential risk	Confirmed behavior	Assessed risk	Resolved or monitored

Key Insights - 3 Insights

Why do we do static analysis before running the file?

Static analysis (Step 2) helps understand the file safely without risk. It shows file info and possible threats before running it in Step 4.

What is the purpose of running the file in a safe environment?

Dynamic analysis (Step 4) lets us see what the file actually does without risking the real system, as shown in the execution table.

How does behavior observation help in malware analysis?

Observing behavior (Step 5) reveals actions like network calls or file changes, which static checks might miss, helping assess threat level.

Visual Quiz - 3 Questions

Look at the execution table, what is the result after Step 3?

A Known malware signatures detected or none

B File is run in a safe environment

C File type and hashes identified

D Report created for response team

💡 Hint

Check the 'Result' column for Step 3 in the execution table.

At which step does the file behavior get recorded?

A Step 2 - Static Analysis

B Step 5 - Behavior Observation

C Step 4 - Dynamic Analysis

D Step 6 - Report Findings

💡 Hint

Look at the 'Action' and 'What Happens' columns in the execution table.

If the file is found safe during static analysis, what happens next?

A Immediately apply mitigation

B Skip dynamic analysis and report safe

C Proceed to dynamic analysis to confirm behavior

D Delete the file without further checks

💡 Hint

Refer to the logical flow in concept_flow and the execution steps.

Concept Snapshot

Malware analysis basics:
1. Receive suspicious file
2. Static analysis: check file info safely
3. Dynamic analysis: run in isolated environment
4. Observe behavior: monitor actions
5. Report findings
6. Apply mitigation to protect systems

Full Transcript

Malware analysis starts by receiving a suspicious file. First, static analysis checks the file's properties without running it to avoid risk. Then, dynamic analysis runs the file in a safe, isolated environment to observe its real behavior. Behavior observation records actions like network connections or file changes. Finally, analysts write a report and apply mitigation steps to protect systems from harm. This step-by-step process helps safely understand and stop malware threats.

Practice

1. What is the main purpose of malware analysis?

easy

A. To understand and identify harmful software

B. To create new software applications

C. To speed up computer performance

D. To backup important files

Solution

1. Step 1: Understand the goal of malware analysis

   Malware analysis is done to study harmful software to know how it works and how to stop it.

2. Step 2: Compare options with the goal

   Only To understand and identify harmful software matches this goal. Other options relate to different computer tasks.

3. Final Answer:

   To understand and identify harmful software -> Option A

4. Quick Check:

   Malware analysis = Understand harmful software [OK]

Hint: Focus on understanding malware's purpose [OK]

Common Mistakes:

• Confusing malware analysis with software development
• Thinking malware analysis improves computer speed
• Mixing malware analysis with file backup tasks

2. Which method is used in static malware analysis?

easy

A. Running the malware in a safe environment

B. Deleting the malware immediately

C. Monitoring network traffic during infection

D. Examining the malware code without executing it

Solution

1. Step 1: Define static analysis

   Static analysis means studying malware without running it, usually by looking at its code or files.

2. Step 2: Match options to static analysis

   Examining the malware code without executing it describes examining code without execution, which is static analysis. Other options involve running or removing malware.

3. Final Answer:

   Examining the malware code without executing it -> Option D

4. Quick Check:

   Static analysis = Code examination without running [OK]

Hint: Static means no running, just code study [OK]

Common Mistakes:

• Confusing static with dynamic analysis
• Thinking static analysis involves running malware
• Assuming deleting malware is analysis

3. Consider this code snippet used in dynamic malware analysis:

log = []
for action in ['open_file', 'modify_registry', 'send_data']:
    log.append(f"Action: {action}")
print(log)

What will be the output?

medium

A. ['open_file', 'modify_registry', 'send_data']

B. Action: open_file
Action: modify_registry
Action: send_data

C. ['Action: open_file', 'Action: modify_registry', 'Action: send_data']

D. Error: log is not defined

Solution

1. Step 1: Understand the loop and append operation

   The loop goes through each action and appends a string with 'Action: ' plus the action name to the list log.

2. Step 2: Determine the final list content

   After the loop, log contains three strings: 'Action: open_file', 'Action: modify_registry', and 'Action: send_data'. Printing log shows this list.

3. Final Answer:

   ['Action: open_file', 'Action: modify_registry', 'Action: send_data'] -> Option C

4. Quick Check:

   Loop appends formatted strings = list with 'Action: ...' [OK]

Hint: Look for string formatting inside loop append [OK]

Common Mistakes:

• Ignoring the 'Action: ' prefix in strings
• Confusing list print with separate print lines
• Assuming a runtime error without reason

4. A malware analyst wrote this code to check if a file is malicious:

def is_malicious(file):
    if file.endswith('.exe') or '.dll':
        return True
    else:
        return False

What is the error in this code?

medium

A. The condition always returns True because of incorrect or usage

B. The function does not return any value

C. The file variable is not defined

D. The function should use 'and' instead of 'or'

Solution

1. Step 1: Analyze the condition in the if statement

   The condition is 'file.endswith('.exe') or '.dll''. The second part '.dll' is a non-empty string, which is always True in Python.

2. Step 2: Understand the effect of the condition

   Because '.dll' is always True, the whole condition always evaluates to True, so the function always returns True regardless of the file extension.

3. Final Answer:

   The condition always returns True because of incorrect or usage -> Option A

4. Quick Check:

   Non-empty string in or condition = always True [OK]

Hint: Check if all parts of 'or' are boolean expressions [OK]

Common Mistakes:

• Thinking the function never returns True
• Assuming file variable is undefined
• Believing 'and' fixes the logic without changing condition

5. You want to create a dictionary summarizing malware actions and their counts from this list:

actions = ['open_file', 'send_data', 'open_file', 'modify_registry', 'send_data', 'send_data']

Which dictionary comprehension correctly counts each action?

hard

A. {action: actions.index(action) for action in actions}

B. {action: actions.count(action) for action in set(actions)}

C. {actions.count(action): action for action in actions}

D. {action: len(action) for action in actions}

Solution

1. Step 1: Understand the goal of counting actions

   We want a dictionary where keys are unique actions and values are how many times each appears.

2. Step 2: Analyze each option

   {action: actions.count(action) for action in set(actions)} uses set(actions) to get unique actions and counts each correctly. {action: actions.index(action) for action in actions} uses index which gives first position, not count. {actions.count(action): action for action in actions} reverses keys and values incorrectly. {action: len(action) for action in actions} counts string length, not occurrences.

3. Final Answer:

   {action: actions.count(action) for action in set(actions)} -> Option B

4. Quick Check:

   Use set for unique keys and count for values [OK]

Hint: Use set() for unique keys and count() for values [OK]

Common Mistakes:

• Using list instead of set for keys causing duplicates
• Using index instead of count for frequency
• Mixing keys and values in comprehension