Cyber-INSEC

Cyber-INSEC
Building REAL security through acceptance of insecurity.

Monday, 8 September 2014

DYBAMIC MALWARE ANALYSIS

Look at it like this; Your drunk, very drunk. Your date looks amazing, and you both get back to your place for some xxx...you don't know her, you didn't care but as she enters your room, in an instant SURPRISE! Your not drunk, your sober, and she looks the definition of nastiness in the eye's and she says "fuck you, I am both nasty and ugly".  If you could play the whole night through, without actually lviing it first, you would save yourself from a coyotee ugly. That's virtualization, emulation and virtualized dynamic analysis with sandboxing.  Read on and you'll understand;

This can used for simple detection of a malicious file, nasty code within a webpage, its code for the reverse engineering of it (the manual was in chinese) when one wants to build a similar malware file, or to develop a signature detection algorithim to add to anti-virus programs.  A virtual environment emulates the real-world, allowing bad actors to operate without the constraints and rule sets one might emplace in order to analyze, yet maintain safety while doing so;  A difficult prospect.  A virtual environment allows the malware to perform its actions, get dirty and wreak its nastiness and havoc, yell and scream, push and shove but  do so all in vain. The virtual environment and its sandbox prevents the ugly date from entering your home, or bed for that matter.

Advanced malware can utilize obsfucation to avoid virtual analysis detection techniques either by sophisticated design, occassionally by chance;  Virtual enviroment emulation are 99% replications, but the 1% can allow for that date to find another way inside your house, even when you haven't brought her home drunk from the bar.

Excellent real-time, virtual malware analysis resource listed below;  Website analysis, java and flash code, android apk's, executables and other files are all uploadeable for scanning and detection.

http://anubis.iseclab.org/?action=advanced_form

No comments:

Post a Comment