malware-analysis-reversing

name	malware-analysis-reversing
metadata	{"category":"Cybersecurity and Penetration Testing"}
description	Production malware analysis workflows, reverse engineering methodologies, isolated sandbox triage, static/dynamic binary analysis, memory forensics, and YARA detection rule authoring.
compatibility	Ghidra, IDA Pro, Volatility 3, YARA, REMnux, pefile / Volatility Python API

Malware Analysis & Reverse Engineering Architecture

Overview

This skill provides technical standards and defensive methodologies for malware analysis and reverse engineering. It covers isolated sandbox setup, static binary inspection (PE/ELF headers, imported functions, packed section detection), dynamic behavior monitoring, memory dump forensics, and authoring YARA rules for threat detection and incident response.

---

1. Malware Analysis Principles & Safety Protocols

1. Strict Air-Gapped / Isolated Sandbox: Always perform malware execution and dynamic monitoring inside isolated virtual machines (REMnux, FLARE VM) with network isolation (INetSim / FakeNet-NG) to prevent lateral movement or C2 callbacks to live networks.
2. Layered Analysis Methodology:
   • Static Triage: File hashing (MD5, SHA256, ssdeep), PE/ELF header analysis, string extraction, and packer detection (PEiD / Detect It Easy).
   • Dynamic Triage: API monitoring, registry/filesystem access tracking (ProcMon), network packet capturing (Wireshark).
   • Code-Level Disassembly / Decompilation: Reverse engineering control flow and functions using Ghidra or IDA Pro.
   • Memory Forensics: Extracting decrypted payloads or process injection artifacts from volatile memory dumps via Volatility 3.
3. Automated Indicator Extraction (IOCs): Extract high-confidence Indicators of Compromise (IP addresses, domain names, file hashes, registry run keys, mutexes) for SIEM ingest.
4. Defensive YARA Rule Generation: Write precise YARA detection rules targeting unique string signatures and byte patterns while minimizing false positives.

---

2. Reverse Engineering & Analysis Pipeline

[ Suspicious Binary Sample ]
       │
       ├──▶ [ 1. Static Analysis ] ──(Hashes, PE Headers, Import Table, Strings)
       │
       ├──▶ [ 2. Dynamic Sandbox ] ──(Process Trees, File/Registry Mutations, PCAP)
       │
       ├──▶ [ 3. Code Reversing ] ───(Ghidra Decompiler, Disassembly Control Flow)
       │
       └──▶ [ 4. Memory Forensics ] ─(Volatility 3 Dump, Extracted Payloads)
               │
               ▼
[ Threat Intelligence & YARA Detection Rules ]

Analysis Stage	Primary Tooling	Key Artifacts / Outputs
Static Triage	pefile, Detect It Easy, ssdeep	Imphash, Subsystem, Entropy, Export/Import Tables
Dynamic Sandbox	Cuckoo Sandbox, CAPEv2, ProcMon	Registry modifications, spawned sub-processes
Network Triage	Wireshark, FakeNet-NG, Suricata	C2 IPs, HTTP User-Agents, DNS queries
Code Reverse Eng.	Ghidra, IDA Pro, x64dbg	Decompiled C code, algorithmic logic, encryption routines
Memory Forensics	Volatility 3, Rekall	Injected DLLs, unpacked memory executable code

---

3. Anti-Patterns & Common Errors in Malware Analysis

• Anti-Pattern: Executing Samples on Host Workstations Outside Isolated Sandboxes
  • Risk: Host OS infection, ransomware encryption, or unauthorized network propagation.
  • Remediation: Always execute samples exclusively within snapshot-revertible VM environments with host-only networking.
• Anti-Pattern: Over-Reliance on Filename or Static File Hashing Alone
  • Risk: Attackers bypass static hash checks effortlessly through polymorphic re-compilation.
  • Remediation: Rely on fuzzy hashing (ssdeep), Import Hashing (imphash), and functional byte-pattern YARA rules.
• Anti-Pattern: Neglecting Packed / Obfuscated Sections
  • Risk: Analyzing only the stub/packer code while missing the actual malicious payload logic.
  • Remediation: Measure section entropy (values > 7.0 indicate packing/compression) and un-pack binary in memory before disassembly.

---

4. Production Python & YARA Code Snippets

A. Python Static PE Header Inspector & Entropy Calculator (pe_analyzer.py)

#!/usr/bin/env python3
"""
Production Static PE Binary Analyzer using pefile
Extracts Hashes, Imphash, Section Entropy, and Suspicious API Imports.
"""

import hashlib
import math
import sys
import pefile

def calculate_entropy(data: bytes) -> float:
    """Calculates Shannon Entropy of a byte buffer (0.0 to 8.0)."""
    if not data:
        return 0.0
    entropy = 0.0
    length = len(data)
    occ = [0] * 256
    for b in data:
        occ[b] += 1
    for count in occ:
        if count > 0:
            p = count / length
            entropy -= p * math.log2(p)
    return round(entropy, 4)

def analyze_pe_binary(file_path: str):
    with open(file_path, "rb") as f:
        content = f.read()

    md5_hash = hashlib.md5(content).hexdigest()
    sha256_hash = hashlib.sha256(content).hexdigest()

    print(f"File: {file_path}")
    print(f"MD5: {md5_hash}")
    print(f"SHA256: {sha256_hash}")

    :
        pe = pefile.PE(data=content)
        ()
        ()
        ()
         section  pe.sections:
            name = section.Name.decode(, errors=).strip()
            entropy = calculate_entropy(section.get_data())
            is_packed =   entropy >   
            ()

        ()
         (pe, ):
             entry  pe.DIRECTORY_ENTRY_IMPORT:
                dll_name = entry.dll.decode(, errors=)
                ()
                 imp  entry.imports:
                     imp.name:
                        func_name = imp.name.decode(, errors=)
                        ()

     pefile.PEFormatError:
        ()

 __name__ == :
     (sys.argv) < :
        ()
        sys.exit()
    analyze_pe_binary(sys.argv[])

---

B. Production YARA Detection Rule (sample_malware_detector.yar)

rule Detect_Suspicious_PE_Loader {
    meta:
        description = "Detects packed executable with suspicious API imports and high entropy sections"
        author = "Threat Intelligence Team"
        date = "2026-08-06"
        severity = "High"

    strings:
        // Unique code bytes pattern (e.g., custom XOR decryption loop)
        $xor_loop = { 8A 04 0E 34 ?? 88 04 0E 41 3B C2 7C F2 }

        // Suspicious strings
        $str1 = "VirtualAllocEx" ascii wide
        $str2 = "WriteProcessMemory" ascii wide
        $str3 = "CreateRemoteThread" ascii wide
        $str4 = "IsDebuggerPresent" ascii wide

    condition:
        // Must be a Windows PE binary
        uint16(0) == 0x5A4D and
        
        // Match specific XOR byte loop OR at least 3 suspicious process injection strings
        ( $xor_loop or 3 of ($str*) ) and

        // PE File size threshold under 10MB
        filesize < 10MB
}