You're reading from Malware Analysis Techniques Tricks for the triage of adversarial software

Product type Paperback

Published in Jun 2021

Publisher Packt

ISBN-13 9781839212277

Length 282 pages

Edition 1st Edition

Languages

Python

Tools

VMware Server

Concepts

Malware Analysis

Author (1):

Dylan Barker

View More author details

Table of Contents (17) Chapters

Preface

1. Section 1: Basic Techniques

2. Chapter 1: Creating and Maintaining your Detonation Environment FREE CHAPTER

3. Chapter 2: Static Analysis – Techniques and Tooling

4. Chapter 3: Dynamic Analysis – Techniques and Tooling

5. Chapter 4: A Word on Automated Sandboxing

6. Section 2: Debugging and Anti-Analysis – Going Deep

7. Chapter 5: Advanced Static Analysis – Out of the White Noise

8. Chapter 6: Advanced Dynamic Analysis – Looking at Explosions

9. Chapter 7: Advanced Dynamic Analysis Part 2 – Refusing to Take the Blue Pill

10. Chapter 8: De-Obfuscating Malicious Scripts: Putting the Toothpaste Back in the Tube

11. Section 3: Reporting and Weaponizing Your Findings

12. Chapter 9: The Reverse Card: Weaponizing IOCs and OSINT for Defense

13. Chapter 10: Malicious Functionality: Mapping Your Sample to MITRE ATT&CK

14. Section 4: Challenge Solutions

15. Chapter 11: Challenge Solutions

16. Other Books You May Enjoy

Using HybridAnalysis

HybridAnalysis is an automated sandbox offering from CrowdStrike utilizing their Falcon Sandbox technology in order to perform rapid triage of malware samples and provide IOCs to analysts.

Navigating to https://hybrid-analysis.com presents us with the following screen:

Figure 4.1 – The HybridAnalysis home page

Here, we can drag and drop a malware sample to be analyzed by the engine. We'll drag our WastedLocker/Locky sample onto the window and begin:

Figure 4.2 – The submission page for HybridAnalysis

After submitting our sample, we'll see the name of our file and have the option to add a comment for the community, as well as a few other options, including one to not submit to any unaffiliated third party.

As with any online, public sandbox, the file will be available to the community as well as CrowdStrike, who owns the HybridAnalysis sandbox, and is shared for intelligence...