haadi@portfolio:~$ cat intro-to-malware-analysis.md
Room notes · SOC Level 1 · Malware concepts for SOC
Intro to MalwareAnalysis
The two fundamental malware analysis techniques: static analysis (without running the malware) and dynamic analysis (running it in a sandbox): and the tools used for each.
What This Room Covers
The two fundamental malware analysis techniques: static analysis (without running the malware) and dynamic analysis (running it in a sandbox), and the tools used for each.
Key Concepts Learned
Static Analysis: examining the file without executing it Static analysis tools extract information from the malware file itself:
- File hash (MD5, SHA-256): unique fingerprint, cross-referenced with VirusTotal
- Strings: readable text embedded in the binary (URLs, file paths, registry keys, error messages)
- PE header: Windows executable metadata: architecture, imports, sections, timestamps
- Imports: DLLs and functions the malware calls, revealing its capabilities
Tools: strings, pestudio, pecheck, floss (for obfuscated strings)
Dynamic Analysis: running the malware in a controlled environment Dynamic analysis observes malware behavior during execution:
- Process creation and tree
- Files created, modified, or deleted
- Registry changes
- Network connections made
- System calls executed
Tools: AnyRun, Hybrid Analysis, Remnux (Linux distribution for malware analysis)
Static analysis is always done first. It is fast, safe (no execution risk), and often reveals enough to classify the malware and extract IOCs. Dynamic analysis is used when static analysis is inconclusive or when you need to see runtime behavior, decrypt obfuscated payloads, or observe C2 communication.
PE (Portable Executable) sections: Windows executables have standard sections:
.text: executable code.data: initialized data.rdata: read-only data (strings, resources).rsrc: resources (icons, version info) High entropy in a section indicates encryption or packing: a sign the malware is obfuscating its contents.
The redline sample (Redline Stealer): analyzed in this room:
- Architecture: 32-bit PE
- Category: credential stealer (browsers, crypto wallets, FTP clients)
- Process tree shows
cmd.exeexecution and backup deletion - Network activity to C2 infrastructure
Task Answers
| Question | Answer |
|---|---|
| Technique for analyzing malware without executing it | Static Analysis |
| Technique for analyzing malware by executing in controlled environment | Dynamic Analysis |
| First step when analyzing new malware | Basic static analysis (file hash, strings, PE header) |
Note: Several answers in this room are VM-specific (file hashes, entropy values, section names) and require running the attached machine. The answers above cover the conceptual questions. The practical questions require completing the room on TryHackMe with the attached VM.
Key Concepts for SOC Work
VirusTotal is the first tool opened for any suspicious file. Submitting the SHA-256 hash immediately shows whether the file is known malicious, which vendor families detect it, and what behavioral indicators have been reported. A 0/72 detection rate does not mean clean: new malware always starts at zero. Context matters enormously.
The imports list reveals capability without execution. A binary importing WS2_32.dll has network socket capabilities. One importing CryptEncrypt from advapi32.dll can encrypt files. Reading imports is a fast way to understand what a malware sample is capable of before any sandbox analysis.
Originally published on GitHub
view-source