decrypting…# Malware Analysis Framework ## Summary > This framework provides a structured, OS-specific approach to analyzing executable malware samples. It is divided into Windows and Linux analysis workflows, each further broken into static and dynamic analysis phases. The goal is to guide analysts through identifying behaviors, capabilities, and potential impact of malware samples, whether packed, obfuscated, or coded in higher-level languages like .NET or Python. ## The Framework ``` If file is an Executable: ├── If Linux Executable: │ ├── Perform ELF Header Analysis │ ├── Check for Packers/Obfuscation (e.g., UPX) │ ├── Use `strings`, `readelf`, `objdump`, `ltrace`, `strace` │ └── Dynamic analysis in isolated Linux VM or sandbox ├── If Windows Executable: ├── Basic Windows Executable Static Analysis │ ├── Calculate hashes (MD5, SHA256) using `certutil` or `hashdeep` │ ├── Identify file type with tools like `TrID` or `Detect It Easy (DIE)` │ ├── Use PEview or CFF Explorer to inspect PE header: │ │ ├── Look at compile timestamp, entry point, import table │ │ └── Note any anomalies in section names (e.g., .text, .rsrc, .data) │ ├── Extract strings using `strings`, FLOSS, or `bintext` │ │ ├── Look for indicators like IPs, URLs, file paths, commands │ │ └── Detect suspicious function names (e.g., `VirtualAlloc`, `CreateRemoteThread`) │ ├── Use DIE or PEiD to check for packers or obfuscators │ ├── Identify whether binary is: │ │ ├── Native C/C++ (no CLR headers) │ │ ├── .NET (CLR runtime header present) │ │ └── Python (PyInstaller/py2exe signatures or large resource section) │ └── Check digital signatures using `sigcheck` or right-click → Properties ├── Basic Windows Executable Dynamic Analysis │ ├── Use a snapshot of a Windows VM (FLAREVM/Cuckoo recommended) │ ├── Run the sample and observe with: │ │ ├── **Process Explorer** – monitor parent-child process trees │ │ ├── **Process Monitor (Procmon)** – trace filesystem, registry, and network activity │ │ ├── **Wireshark or FakeNet-NG** – detect outbound connections │ │ ├── **Autoruns** – identify persistence attempts │ │ └── **TCPView** – real-time view of network connections │ ├── Log all activities: file creation, registry keys written, processes spawned │ └── Terminate and restore snapshot after behavior is captured ├── Advanced Windows Executable Static Analysis │ ├── If Native C/C++: │ │ ├── Load into Ghidra or IDA Free │ │ │ ├── Analyze functions, string references, import tables │ │ │ └── Label common APIs and look for suspicious patterns (e.g., shellcode runners) │ │ ├── Look for known API calls used in: │ │ │ ├── Process Injection (VirtualAllocEx, WriteProcessMemory) │ │ │ ├── Network (WinInet, WinHTTP, socket) │ │ │ └── Persistence (RegSetValue, CopyFile) │ │ └── Analyze control flow for obfuscation or loops masking behavior │ ├── If .NET: │ │ ├── Use dnSpy or ILSpy to fully decompile the binary │ │ │ ├── Review namespaces, embedded resources, base64 blobs │ │ │ ├── Identify use of reflection or `Assembly.Load` │ │ │ └── Look for dynamic code execution: PowerShell, C# injection │ ├── If Python: │ │ ├── Use `pyinstxtractor.py` to extract the `.pyc` or embedded archive │ │ ├── Decompile with `uncompyle6` or `pycdc` │ │ └── Review logic, imports, and dropped files │ └── Examine imported/exported symbols with `Dependency Walker` or `CFF Explorer` ├── Advanced Windows Executable Dynamic Analysis │ ├── Setup an advanced sandbox (INetSim, Noriben, Cuckoo with WinDbg integration) │ ├── Use API monitoring tools: │ │ ├── **API Monitor** – hook specific DLL/API calls (e.g., kernel32, advapi32) │ │ └── **HookExplorer/x64dbg** – monitor real-time function calls and patch breakpoints │ ├── Memory analysis: │ │ ├── Use ProcDump or Process Hacker to dump memory of suspicious processes │ │ ├── Scan memory dumps with YARA for indicators or unpacked payloads │ │ └── Use volatility to analyze memory (DLL injection, loaded drivers, network activity) │ ├── Monitor anti-analysis techniques: │ │ ├── Detect sleep/delays using `sysinternals-timeliner` │ │ ├── Check for VM evasion (e.g., RDTSC, CPUID, MAC address checks) │ │ └── Use breakpoints to bypass anti-debugging (`IsDebuggerPresent`, `NtQueryInformationProcess`) │ ├── Network emulation: │ │ ├── Emulate DNS/HTTP responses via INetSim │ │ ├── Inspect outbound C2 communication (Beacon intervals, encryption patterns) │ │ └── Identify downloaders or staged payloads │ ├── If coded in C: │ │ ├── Perform static disassembly (Ghidra/IDA) │ │ ├── Look for common API calls (e.g., CreateProcess, Wri teFile) │ │ └── Dynamic analysis in FLAREVM/Cuckoo │ ├── If coded in .NET: │ │ ├── Use dnSpy/ILSpy for decompilation │ │ ├── Analyze assemblies and embedded resources │ │ └── Check for PowerShell or other script injectors │ ├── If coded in Python (PyInstaller, Py2exe): │ │ ├── Extract .pyc or .pyo using tools like pyinstxtractor │ │ ├── Decompile with uncompyle6 │ │ └── Look for dropped scripts or embedded binaries │ └── Perform behavioral analysis with Process Monitor, API Monitor If file is a Script: ├── If VBS Script: │ ├── Open in safe viewer (e.g., Notepad++, ViperMonkey) │ ├── Look for obfuscation (e.g., chr(), base64) │ ├── Extract and analyze embedded commands │ └── Sandbox execution with monitoring tools ├── If PowerShell Script: │ ├── Beautify and deobfuscate code (Invoke-Obfuscation analysis) │ ├── Search for encoded commands or IEX │ ├── Analyze for web calls, file writes, registry edits │ └── Dynamic execution in safe Windows VM with logging ├── If JavaScript: │ ├── Use jsbeautifier to deobfuscate │ ├── Look for eval(), document.write(), ActiveXObject │ └── Analyze in browser sandbox (e.g., Malzilla) ├── If Batch File: │ ├── Analyze command logic and redirections │ ├── Check for payload droppers or downloader logic │ └── Execute in isolated environment to capture IOCs If file is a Document: ├── If Microsoft Office (doc, xls, ppt): │ ├── Scan with olevba/oletools │ ├── Look for macros, embedded objects, DDE │ └── Open in safe VM with Office logging enabled ├── If PDF: │ ├── Use pdfid.py and pdf-parser.py to inspect │ ├── Search for JavaScript and suspicious actions │ └── Render in sandboxed PDF reader ├── If RTF: │ ├── Use RTFScan │ ├── Look for OLE objects and shellcode │ └── Extract payloads for further analysis If file is an Archive: ├── Extract safely (7zip, zipdump) ├── Scan contents individually through the tree └── Check for password-protected content or nested archives If file is a Shortcut (LNK): ├── Inspect with LECmd or lnk-parser ├── Look for hidden paths and remote payload URLs └── Extract embedded shellcode or script paths If file is a Macro or Embedded Script: ├── Use olevba, mraptor, oledump ├── Check for base64, hex, GZIP or ROT encodings └── Analyze macro execution chains ``` ## ⚠️ Usage Warning - Only analyze malware in a secure, isolated environment (e.g. sandbox or VM). - Never run malware on a production or internet-connected system. - Use this framework only in accordance with local laws and regulations. The creators are not responsible for any misuse or legal consequences resulting from the use of this framework.