Analyzing Malware Basics

Level: 6 - Real World Reverse Engineering Prerequisites: 55_emulator_use_cases.md What You Will Learn: A safe, systematic approach to analyzing suspicious binaries using Rerius.

Safety First#

Never run malware on your analysis machine without appropriate isolation. Use a virtual machine or a dedicated analysis device that you can restore to a clean state.

Rerius is a static analysis tool. It never executes the binary. This makes it safe to use on malware: you are reading the binary file, not running it.

Initial Triage#

When you receive a suspicious binary, run a quick triage before deep analysis:

./rerius -l -y -t -e /path/to/suspicious

This gives you: 1. Section layout (are the section names normal?) 2. Import symbols (what capabilities does it use?) 3. Strings (what does it talk about?) 4. Entropy (is it packed?)

From these four pieces of information, you can form a first hypothesis about what the binary does.

Reading the Import Table#

The most revealing quick analysis for malware is the import table. The functions a binary imports from system libraries directly reveal its capabilities.

Look for these categories of imports:

File operations: CreateFile, ReadFile, WriteFile, DeleteFile, CopyFile (Windows) or open, read, write, unlink (Linux/macOS)

Network operations: connect, send, recv, gethostbyname, WSAStartup, socket

Process operations: CreateProcess, OpenProcess, VirtualAlloc, WriteProcessMemory

Registry operations (Windows): RegOpenKey, RegSetValue, RegDeleteKey

Cryptography: CryptEncrypt, CryptDecrypt, MD5Update, SHA1Final

Anti-analysis: IsDebuggerPresent, CheckRemoteDebuggerPresent, GetTickCount (timing check), VirtualQueryEx (checking for analysis tools)

The Analysis Workflow#

A structured approach:

1. Triage: Section layout, imports, strings, entropy.
2. Identify the entry point behavior: What does the startup code do? Does it check for debuggers? Set up persistence?
3. Find communication: Look for network-related imports and the functions that use them.
4. Find payload execution: If the binary downloads or decrypts code, find where that code is executed.
5. Understand the purpose: Combine all findings into a description.

Common Patterns in Malware#

Dropper: Downloads or extracts a second payload and executes it. Look for file write operations followed by process creation.

Loader: Decrypts a payload in memory and executes it without writing to disk. High entropy data section, VirtualAlloc with execute permission, function pointer call.

RAT (Remote Access Tool): Connects to a C2 server, receives commands, executes them. Network operations combined with command dispatch (switch table) and system operations.

Ransomware: Enumerates files, encrypts them, writes ransom note. File enumeration operations, crypto functions, file write operations.

Practice#

1. If you have a safe, known malware sample (from a CTF or an analysis sandbox), run the initial triage.
2. List the imported functions and categorize them.
3. Find the most-called internal function and determine what it does.

Next#

Continue to 61_crackme_walkthrough.md.