Malware Analysis is necessary to understand the following:
What is the purpose of the malware?
How did it get into your organization?
Who is targeting you and how good are they?
How can you get rid of?
What did they steal?
A Malware Analysis is carried out in various phases to ensure clear planning and delivery model.
Fully-automated analysis: We first analyse the malware using fully-automated tools understand what malware is capable of. This is the fastest method to analyse large quantities of malware.
Static properties analysis: The static properties analysis includes analysis of hashes, embedded strings, embedded resources, and header information etc.
Interactive behaviour analysis: We then observe the interactive behaviour of the malware to see if the malicious file tries to attach to any hosts. This give us a better understanding how malware works over automated tools.
Manual code reversing: Reversing the code of the malicious file can decode encrypted data that was stored by the sample by using the debugger and disassembler.
The outcome of malware analysis will include an executive summary and a technical finding report. The executive summary includes overview of analysis activities, scope, how the malware can impact your organization. The technical findings report will include a detailed description of the analysis of the malware.
Our security engineers will walk the client through the information provided, make any updates needed, and address questions regarding the incident. Following the submission of the initial report, we’ll provide new revisions of documentation and schedule any formal analysis, if applicable.
