pentest-malware

pentest-malware

Malware analysis advisory — static, dynamic, IOC, YARA. An isolated sandbox is mandatory for active analysis (never in production).

Triggers

• "malware analysis"
• "sample triage"
• "Cuckoo / VMRay sandbox"
• "RE with IDA / Ghidra"
• "write a YARA signature"
• "packer detection"
• "IOC extract"

Triage Flow

1. Compute hash (SHA256)
2. VirusTotal query (is an offline detection available)
3. Strings + magic byte
4. Packer detection (PEiD, DIE)
5. Static disassembly (Ghidra/IDA)
6. Dynamic sandbox (Cuckoo, Any.run)
7. Network IOC (C2 domain, IP, JA3)
8. Write a YARA signature
9. Report

Hash + VT Lookup

# Hash
sha256sum sample.exe
md5sum sample.exe

# VT (API key required, offline report)
curl -s "https://www.virustotal.com/api/v3/files/$(sha256sum sample.exe | cut -d' ' -f1)" \
  -H "x-apikey: $VT_KEY" | jq '.data.attributes'

# A prior analysis may surface via the hash -> skip dynamic

Static Analysis

# File type
file sample.exe
file sample.bin

# Strings (ASCII + UTF-16)
strings -a -el sample.exe | grep -iE 'http|cmd|powershell|exec|reg|task'
strings sample.exe | grep -iE '\.exe$|\.dll$|\.bat$'

# PE header (Windows)
pefile.py sample.exe              # imports, exports, sections
peframe sample.exe                # high-level summary
DIE / Detect It Easy              # packer/protector detect

# ELF (Linux)
readelf -a sample.elf
objdump -d sample.elf | head

Packer Detect + Unpack

Packer	Detect	Unpack
UPX	DIE / upx -l sample.exe	upx -d sample.exe
ASPack	DIE	OllyScript / ESP trick
Themida	DIE (full match)	Manual / VMProtect unpacker
Custom	Unknown signature	Sandbox + memory dump
.NET obfuscation	dnSpy strings	de4dot, ConfuserEx unpacker

Dynamic Sandbox (Isolated)

# Cuckoo (self-hosted)
cuckoo submit --machine win10-clean sample.exe
# Result: behavior log, network capture, dropped files, registry changes

# REMnux (Linux analysis distro)
inetsim                          # fake internet (DNS, HTTP, SMTP)
oletools / olevba.py             # Office macro extract