Basic Static and Dynamic Analysis cheatsheet
This cheatsheet is not indepth and detailed. It will only cover the required minimum
Might make a more indepth version when required.
Basic Static Analysis
- Malware Fingerprint
- AV Scanning
- Hashing
- VirusTotal
- AV Scanning
- Finding String in Malware
- Representation of Strings
- ASCII (1 Byte), Hexadecimal
- Unicode (2 Bytes)
- BinText: String Extraction Tool
- Representation of Strings
- Portable Executable Format
- Source to Execution
- Compiler: Translates high-level code to machine code
- Linker: Links
.obj
files into a single.exe
executable - Loader: Allocates memory space and prepares the execution file
- Linking
- Static Linking: Library copied into executable at start
- Dynamic Linking: Searches and loads library at runtime
- Loading a PE
- Absolute Loading: Same address
- Relocatable Loading: Different address based on availability
- Dynamic Run-time Loading: Different address while running
- Address Binding: Binding of Virtual Address to Physical Address
- Relative Virtual Addresses
- Base Address
- PE File Format
- PE Sections
.edata
(Export Data).reloc
(Base Relocation)
- Dependency Walker: See
.edata
&.idata
- PEView: View files when compiled
- PE Sections
- Packing Executable
- PEiD: Detect packed PE
- PEiD Unpacker: Use plugins to unpack
- PEiD: Detect packed PE
- Indicators of Malware
- Host-based Indicators: Affect the system (files, registry, process operations)
- Network-based Indicators: Communicate with external IPs and URLs (Internet, socket operations)
Basic Dynamic Analysis
- Running the Malware
- Sandboxes
- GFI Sandboxes
- Mutex: Prevents multiple threads/processes from accessing a resource
- Sandboxes Drawbacks
- GFI Sandboxes
- rundll32.exe: (Run DLL with export arguments)
- Sandboxes
- Process Monitoring
- procmon: Historical monitoring
- Process Explorer: Live monitoring
- Registry Monitoring
- regshot: Compare registry before and after
- CaptureBat
- Network Monitoring
- ApateDNS: Fake a network (127.0.0.1)
- Change Local Host in TCP/IP properties to
127.0.0.1
- Change DNS reply address in ApateDNS to
127.0.0.1
- Change Local Host in TCP/IP properties to
- NetCat: Command
nc -l -p 443
(-l is a lowercase L) - Wireshark
- ApateDNS: Fake a network (127.0.0.1)
All articles on this blog are licensed under CC BY-NC-SA 4.0 unless otherwise stated.