Difference between Static and Dynamic Malware Analysis

[Deleted member 21043]

Hi everyone,

This is just a short thread to cover the difference between Static and Dynamic analysis. I gathered having a Malware Analysis forum introduced would require people to know the difference (for those who want to be involved with the forum) so I decided to post a thread on it.

Static Analysis will allow you to analyze the sample without actually executing it. This involves reverse engineering, unpacking, HEX checking, ...

Reverse Engineering/Disassembling is very useful. A very common tool used by Malware Analysts for disassembling a binary file is IDA Pro; there is a Free version of IDA, you could use this for training. If you cannot afford IDA Pro, then you can use IDA Free. But, IDA Pro is better.

Dissassembling a binary file will allow you to have the machine code to the binary file translated to something more readable... Such as Assembly. For anyone who does not know, Assembly is a programming language.

You can find more information about IDA at this website: https://www.hex-rays.com/products/ida/index.shtml

Dynamic Analysis will allow you to analyze the sample by executing it. When the sample is executing, you can monitor it's behaviour. Such as, what folders it tries to access, if it drops any files and then do analysis on the dropped files, the API calls made, any connections being made (is it trying to connect to a C&C (Comand and Control) server?), ...

I recommend taking a look at Malcode Analysts Pack. It's got a set of tools to get you started. You'll need a lot more as you progress and improve, but it does offer some nice tools. You can download it from the following URL: http://www.woodmann.com/collaborative/tools/index.php/Malcode_Analysis_Pack

Should anyone be confused about Static and Dynamic analysis still, please mention below in the comments and I will try to help you understand it better.

A debugger is also useful to Malware Analysts. (e.g. WinDbg).
I will make a thread about tools you can use for Malware Analysis. I will also attach the public tutorial for the tools, as you will need to read them first before using the tools.

Cheers.

 

[hjlbx]

Thank You, kram...

 

[LabZero]

Thanks, great explanation

 

[LabZero]

It might also be useful Regshot for comparing registry change before and after infection ?

 

[Deleted member 21043]

It might also be useful Regshot for comparing registry change before and after infection ?

Yes, it's useful to use Regshot for comparing the registry changes from before and after infection. I was going to mention this in the next thread I make with the list of tools. Regshot is a very useful tool.

Cheers.

 

[LabZero]

Just a comment in the case of ransomware.
I think it's better to do an analysis
basic static to determine what makes malware and if running in a virtual environment is safe, before making the dynamic analysis.

 

[sinu]

Which antivirus is using which method?

 

[Deleted member 21043]

Which antivirus is using which method?

Static analysis for an Antivirus would be when it detects an object before you execute ("run") it e.g. when you save it to the hard disk.
Dynamic analysis for an Antivirus would be detecting an object as it is executing (HIPS/BB for example).

The well known Antivirus products you see today usually have both. An example of a product which supports both: Emsisoft - it has the Real-Time protection for static analysis and then the BB (Behaviour Blocker)/HIPS (Host Intrusion Prevention System) for dynamic analysis.

 

[sinu]

Tiranium have static analysis (real-time) and some sort of BB/HIPS protection, however the BB/HIPS is not very good because while it may detect things, it won't be able to detect the process responsible... Regardless, I advise not to use Tiranium, I would never trust it.

Personally, I have not actually used Roboscan well enough to give you a lot of information about it, but it does support static analysis (real-time protection).

However, I do not recommend it compared to the other options available.

Can you please suggest me a free antivirus which is good in both types of detection

 

[Deleted member 21043]

Can you please suggest me a free antivirus which is good in both types of detection

avast! Free: https://www.avast.com/en-gb/index

It has a feature called DeepScreen! which works by sending the program to the cloud and executing it in a virtual environment. Afterwards, it will report back if it found it to be safe/malicious based on it's activity in the virtual environment running on the cloud. Which is always good for additional protection.

However: we should stay back on topic because this thread is completely unrelated to which AV should be used and my recommendations.

 

[sinu]

avast! Free: https://www.avast.com/en-gb/index

It has a feature called DeepScreen! which works by sending the program to the cloud and executing it in a virtual environment. Afterwards, it will report back if it found it to be safe/malicious based on it's activity in the virtual environment running on the cloud. Which is always good for additional protection.

However: we should stay back on topic because this thread is completely unrelated to which AV should be used and my recommendations.

OK thank you