Static Analysis Walkthrough: Tools and Techniques for Malware Analysis

Static analysis is a fundamental method in cybersecurity for examining software binaries without executing them. By leveraging various tools, analysts can extract valuable insights into the structure, behavior, and potential maliciousness of code. This walkthrough provides an overview of key tools and techniques used in static analysis, focusing on Linux-based tools while highlighting alternatives for Windows.

---

1. Strings

The strings utility is a simple yet powerful tool that extracts human-readable text from binary files.

Usage

• Run strings [filename] to list all readable strings in a binary.
• Use grep to filter specific keywords, e.g., strings [filename] | grep pass to find occurrences of “pass.”
• Use less to paginate the output for easier navigation.

What It Reveals

• API Calls: Extracts references to libraries and functions (e.g., iphlpapi.dll).
• Sensitive Data: Identifies strings like passwords, IP addresses, or domains.

---

2. PE-Tree

PE-Tree is a tool for analyzing Portable Executable (PE) files, commonly used in Windows.

Key Features

• File Metadata: Displays file size, hash values (MD5, SHA1, SHA256), and import hashes (imphash).
• Entropy Analysis: Indicates randomness in a file (high entropy suggests encryption or compression).
• Header Details: Provides information like entry points, file type (32-bit or 64-bit), and PE sections (e.g., .text, .data).
• Hash Verification: Hash values can be used to search databases like VirusTotal to determine if the file is known to be malicious.

---

3. PE-Frame

PE-Frame provides an exhaustive analysis of PE files, offering detailed insights into their behavior and characteristics.

Key Features

• Obfuscation Detection: Identifies techniques like XOR encoding or packing.
• Anti-Debugging Features: Detects mechanisms designed to prevent reverse engineering.
• Function and API Analysis: Lists libraries and functions called by the binary.
• Behavioral Insights: Highlights potential network connections (e.g., IP addresses) and breakpoints for dynamic analysis.

Practical Use

• Analyze suspicious sections for packed code or encrypted regions.
• Identify potential anti-debugging mechanisms used by malware.

---

4. VirusTotal

VirusTotal is an online platform that aggregates malware detection results from multiple antivirus engines.

How to Use It

• Copy a hash value (e.g., MD5 or SHA256) from a file and search it on VirusTotal.
• Check for classification and detection results from different security vendors.

---

5. MalAPI.io

MalAPI.io helps classify malware based on the APIs it uses.

Key Features

• API Categorization: Maps APIs to specific malware behaviors (e.g., enumeration, injection, spying).
• Family Identification: Provides insights into the malware type (e.g., ransomware, spyware) based on its API usage.

---

6. Ghidra

Ghidra, a reverse engineering framework developed by the NSA, is a powerful tool for static analysis.

Capabilities

• Decompilation: Converts binary code into human-readable C-like code.
• Function Analysis: Maps out functions, their arguments, and return values.
• Network Insight: Identifies IP addresses and traces their usage in functions related to network activity.

How to Use Ghidra for Static Analysis

• Load the binary and analyze its structure.
• Identify suspicious functions, such as those involving socket connections or data encryption.
• Cross-reference function calls with API usage to map out the malware’s behavior.

---

Static Analysis Workflow

1. Preliminary Analysis with Strings: Extract readable text for initial insights.
2. PE Analysis: Use tools like PE-Tree and PE-Frame to examine file headers, entropy, and behavior.
3. API and Function Analysis: Investigate API calls and their purposes using tools like MalAPI.io and Ghidra.
4. Hash Verification: Validate the binary using VirusTotal.
5. In-Depth Reverse Engineering: Use Ghidra to dissect functions and understand complex code behavior.

---

Conclusion

Static analysis enables cybersecurity professionals to detect and understand malicious code effectively. Tools like strings, PE-Tree, PE-Frame, VirusTotal, MalAPI.io, and Ghidra offer powerful capabilities for extracting critical insights. Combining these tools with a structured workflow ensures a thorough analysis, helping analysts identify vulnerabilities, obfuscation techniques, and malicious functionality.