Analysis tools in action
By the time you’ve reached this section, you should have downloaded the required tools and prepared your guest sandbox environment, so now you’re ready to start analyzing your first malware sample. The analysis process will be divided into two phases:
- The static analysis phase
- The dynamic analysis phase
Static analysis phase
In this phase, we aim to scan the suspected file and determine the type of malware by utilizing the YARA tool and extracting valuable information using straightforward tools such as the Exeinfo and PEstudio tools. So, let’s deep-dive into the steps of this exciting phase of the analysis.
Run the compute hash tool on the suspicious file to collect the file hash and then investigate the file hash reputation on threat intelligence platforms such as VirusTotal and IBM X-Force.
Run YARA rules against the suspected malware file to scan it and identify its malware category and family, if applicable...
