PRACTICAL MALWARE ANALYSIS Kris Kendall （实际的恶意软件分析克里斯肯德尔）.pdf

PRACTICAL MALWARE ANALYSIS Kris Kendall kris.kendall@ WHY PERFORM MALWARE ANALYSIS? What are some of the reasons that one might want to invest the (sometimes significant) resources required to effectively analyze malware? Imagine that you are in the unenviable position of finding some unknown, running, and potentially malicious executable program on an important server. In this situation, some very important questions can be answered— and usually, can only be answered—by conducting malware analysis. Malware analysis can be conducted with a variety of goals in mind. Some of the common reasons that you might want to analyze a malicious program include: • To assess damage from an intrusion • To discover and catalogue indicators of compromise that will reveal other machines that have been affected by the same malware or intruders • To determine the sophistication level of the malware author • To identify the vulnerability that was exploited to allow the malware to get there in the first place • To identify the intruder or insider that is responsible for installing the malware • To learn and have fun! By extending a common definition of the word “analysis”, we define malware analysis as “the action of taking malware apart to study it”. While you are studying the malware, your purpose is to discover the answers to questions about the malware. These questions can be broken down into “business” questions and “technical” questions. Some of the most common business questions answered by malware