Basic Malware Static Analysis

---

Static malware analysis the process of analyzing malware without executing it, but in a controlled environment.

Using Linux

1. Determine file type with file <filename>
   • obfuscated (double extension) file extensions are suspicious
2. Check for any human-readable strings using strings <filename>
   • can use less/more
   • redirect to a file strings <filename> > strings.txt
   • may find function names, domains, URLs, IPs, etc.
3. Get file hash sha256sum <filename>
4. Analyze with VirusTotal
   • use hash rather than uploading file
   • check AV vendor results
   • check Details, Relations, Behavior, and Community comments

Reference

Intro to Malware Analysis. (2023). TryHackMe. https://tryhackme.com/room/intromalwareanalysis