Summary

In this chapter, we discussed malware analysis and some of the techniques for analysis. Malware analysis is a powerful tool and skill to have; it can help make determinations about whether the organization is targeted or just caught up in an opportunistic campaign. There is much more to malware analysis than what has been discussed; for example, analysis frameworks such as Cuckoo SandBox and full-on reverse engineering with debuggers. There are full courses covering that part of the subject and it is beyond the scope of what can be covered in a single chapter.

That being said, some important concepts were covered, including static analysis and how you can determine what kind of file you are working with, if it is packed, and how to make determinations about some of its functions based on its imports. We also covered dynamic analysis where a sample is actually executed and from the tools we can look at processes as well as network, operating system, and filesystem activity...