Let's start by answering the obvious question, what is malware analysis?
Malware analysis is a study of determining the functionality, origin and potential impact of a given
malware sample.
That is what it does, where it came from and how much damage can it do?
Let's look at a Real-Life example to understand this better.
Consider the war scenario between two entities, and you are a soldier in one of the two entities.
If you see a soldier of the opposite side approaching your territory, what would you do?
You would shoot him down.
Now, let's consider another scenario in which you suspect one of the soldiers on the other side is
actually a spy and working for the enemy, and due to his strange behavior, you identify him.
What do you do now?
Do you shoot and kill him?
Probably not, because now you have so many questions that you want answers for, like what is intention?
What he knows about us.
What is he carrying with him?
What has he communicated to the enemy?
How did he get in our team in the first place?
What are the bigger plans of the enemy, etc.
Similarly, if there is a malware being downloaded from the Web or being sent from an e-mail, it is
blocked and deleted.
However, if we notice a malware already inside our network that somehow sneaked into our network,
then we want to understand its origin, its intentions and the damage it could possibly do.
This is done through the process of malware analysis.
So what are the goals of malware analysis?
The primary goal is to understand the intentions of the malware, like,
Is it communicating to anyone in the Internet?
Is it collecting any information from the system or network?
Is it encrypting and files?
Is it attempting to stop any services or is it creating or deleting any files?
Is it looking for anything specific, like database server or email server?
Secondly, malware analysis will help in understanding if the malware is targeted or a commodity market.
Finally, malware analysis will help in improving the defense, depending on what the malware
is targeting, we can step up the security around those servers or applications.
At this point, one should understand the difference between malware analysis and handling a malware
alert.
As a security analyst, we would get malware alerts triggered directly from a antivirus solution or through some
suspicious behavior which are typically identified in the form of correlation rules, for example, high
CPU utilization, connection to command and control or scanning by unauthorized host.
In these cases, we try to identify the cause of the suspicious behavior through malware alert handling
playbooks.
This is not the same as a analysis.
In fact, the end result of working on a malware alert could lead to malware analysis.