Malware Analysis

---
name: malware-analysis
description: Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.
---

# Malware Analysis

## Authorization preamble

1. Confirm the analysis is authorized routine work (own samples, lab, or engagement scope).
2. Confirm the task hits this skill's scope.
3. Verify tool availability and real paths before running anything.
4. Work order: triage → static → sandbox dynamic → rules → IOCs.

> YARA / Sigma / sandboxing / IOC extraction / anti-analysis
> Static + dynamic + behavioral in one flow.

## Scope

- Malware sample analysis (PE/ELF/Mach-O/APK/scripts)
- YARA rule writing and validation
- Sigma behavioral detection rule generation
- Sandbox automation and orchestration
- IOC extraction and threat intel
- Anti-analysis technique detection and bypass

## Six-phase analysis flow

### Phase 1: Initial triage

```bash
file sample.exe                      # file type
strings sample.exe | grep -i "http\|cmd\|powershell\|base64"  # quick IOCs
rabin2 -zz sample.exe                # strings + xrefs
floss sample.exe                     # deobfuscated strings (FLARE)

# PE header analysis
pecheck sample.exe                   # PE structure validation
pescan sample.exe                    # anomaly detection (sections, entry point)
diec sample.exe                      # Detect It Easy (packer/compiler)

sha256sum sample.exe
# → query VirusTotal / MalwareBazaar / Triage
```

### Phase 2: Static analysis

```text
Disassembly / decompilation:
□ IDA Pro / Ghidra: deep decompilation
□ radare2: fast CLI analysis
□ x64dbg: Windows GUI debugger

Key regions:
□ Entry point → initialization logic
□ Import table → API intent (CreateRemoteThread=inject, CryptEncrypt=ransom)
□ Resource section → embedded payload (.rsrc)
□ String table → URLs / C2 / paths / Base64 blobs
□ TLS callbacks → run before debugger attach
```

### Phase 3: Sandbox dynamic analysis

```text
Automated sandboxes:
□ Joe Sandbox / ANY.RUN / Triage: commercial
□ CAPE Sandbox: open source + YARA integration (recommended)
□ Cuckoo Sandbox: classic open source (superseded by CAPE)

Monitoring focus:
□ Process creation: CreateProcess / ShellExecute
□ File ops: WriteFile → ransomware? DeleteFile → wiper?
□ Registry: Run/RunOnce persistence
□ Network: HTTP/DNS → C2
□ Memory: VirtualAllocEx → process injection
□ Services: CreateService → persistence
```

### Phase 4: YARA rule writing

```yara
rule MalwareFamily_Example {
    meta:
        description = "Detects the Example malware family"
        severity = "high"
        mitre_id = "T1055"  // Process Injection

    strings:
        $str1 = "C2_SERVER_URL" ascii wide
        $str2 = "payload.dat" ascii
        $hex1 = { 8B 45 ?? 50 FF 15 [4] 85 C0 }
        $re1 = /https?:\/\/[a-z0-9.-]+\/[a-z]{3,8}\.php/ ascii

    condition:
        uint16(0) == 0x5A4D and     // MZ header
        filesize < 500KB and
        (2 of ($str*) or $hex1)
}
```

### Phase 5: Sigma rule generation

```yaml
title: Suspicious Process Injection via CreateRemoteThread
id: 5a3d2c1b-1234-5678-9abc-def012345678
status: experimental
tags:
    - attack.t1055          # Process Injection
    - attack.t1055.001      # DLL Injection
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'CreateRemoteThread'
            - 'VirtualAllocEx'
            - 'WriteProcessMemory'
    condition: selection
falsepositives:
    - legitimate debugging tools
level: high
```

### Phase 6: IOC extraction and intel

```text
□ Network IOCs:
  - IP: C2 addresses (mind freshness)
  - Domain: DGA-generated names
  - URL: payload hosting
  - User-Agent: custom UA strings

□ Host IOCs:
  - File paths: %APPDATA%\Microsoft\Crypto\RSA\*.dat
  - Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
  - Mutex: Global\{GUID}
  - Service names disguised as system services

□ Behavioral IOCs:
  - MITRE ATT&CK technique IDs (T1055, T1003, T1571...)
  - Sigma rules → SIEM
  - YARA rules → EDR

□ Static IOCs:
  - Compile timestamps (forgeable)
  - PDB paths (developer info)
  - Non-standard section names
  - Odd import combinations (e.g. CryptEncrypt + DeleteShadowCopies)
```

## Anti-analysis quick reference

| Technique | Detection | YARA trait |
|-----------|-----------|------------|
| VM detection | WMI Win32_BIOS/VideoController/Processor | `Win32_` strings + vendor names |
| Sandbox detection | disk < 60GB, RAM < 2GB, single core | GlobalMemoryStatusEx call pattern |
| Debugger detection | IsDebuggerPresent, CheckRemoteDebuggerPresent | PEB.BeingDebugged offset access |
| Timing escape | Sleep(300000) before payload | NtDelayExecution with long arg |
| Geo detection | keyboard layout / timezone checks | GetKeyboardLayoutList calls |
| Parent process check | explorer.exe vs cmd.exe | process name comparison |
| Direct syscalls | EDR hook bypass | syscall instruction + SSN resolution |

## Toolchain

| Tool | Purpose | Get |
|------|---------|-----|
| Ghidra / IDA Pro | deep decompilation | ghidra-sre.org |
| CAPE Sandbox | open-source malware sandbox | github.com/kevoreilly/CAPEv2 |
| YARA | pattern matching engine | `pip install yara-python` |
| Sigma | SIEM detection rules | github.com/SigmaHQ/sigma |
| FLOSS | deobfuscated strings | `pip install flare-floss` |
| Detect It Easy | packer/compiler detection | github.com/horsicq/Detect-It-Easy |
| pe-sieve | process memory scanning | github.com/hasherezade/pe-sieve |
| VirusTotal API | multi-engine scan | virustotal.com |
| MalwareBazaar | sample library | bazaar.abuse.ch |

## References

- `references/yara-sigma-rules.md` — YARA + Sigma authoring methodology
- `references/sandbox-orchestration.md` — sandbox orchestration and automation
- `references/anti-analysis-techniques.md` — anti-analysis technique detection

## Completion self-check (MUST pass before claiming completion)

- [ ] Did I execute every step of the workflow (rather than just read it)?
- [ ] Did I use real tool paths?
- [ ] Did I produce reproducible evidence (commands / scripts / reports)?
- [ ] Did I write back the required checklist items?