Even though we have not reached a point where we have defined malware analysis, it is basically a process
of understanding what a malware does.
Malware is developed by the hacker using some programming language.
The easiest way to understand what an application does is by reading the code line by line.
But as we discussed earlier, it is not the actual file with set of instructions that will be downloaded
by the end user.
Instead, it will be a compile version that is a binary file.
So the common sense says, if you want to understand what the program is, then read the instructions
in the binary file.
However, it is not so easy.
The process of compilation changes the set of Line-by-line instructions into a machine readable format.
If we open a binary file in a text editor, this is what we get, most of it seems gibberish except
for a few traces of readable words, which we call strings.
Compare it to a real life analogy.
Let's bring back our Pizza example.
Before the pizza is cooked, we can easily identify all the ingredients that goes into making the pizza.
But once it undergoes the process of cooking, how much of the ingredients can we get back?
The raw materials would have changed their form.
Ingredients like salt will not be visible.
That is, it is almost impossible to get ingredients back once the pizza is cooked.
Similarly, once the program is written and compiled, it is very difficult, if not impossible, to
get the original set off line by line instructions.
This is why malware analysis seems difficult.
The process involves the use of various tools and skill set that will help in understanding the function
of a malware from such binary files.