Detailed Malware Analysis Report: Types, Analysis, and Prevention

This report provides a comprehensive analysis of malware, beginning with an introduction to malware and its various types, including spyware, viruses, worms, and Trojans. It delves into the methods used in social engineering attacks, such as baiting, scareware, and phishing, and discusses prevention techniques like multi-factor authentication and anti-virus software. The report examines both static and dynamic analysis methods, detailing the use of tools, virtual machines, and IP analysis for malware detection. Furthermore, it explores the construction of training datasets for machine learning classifiers, malicious DNS detection, and malware configuration. The report also includes questions and answers related to the topics covered, offering a thorough understanding of malware and its impact on computer systems.

Table of Contents
1. Introduction...........................................................................................................................................1
1.1 Malware................................................................................................................................................1
1.2 Types of malicious software................................................................................................................1
2. PART A-Questions and Answers.........................................................................................................3
3. PART B- Questions and Answers.........................................................................................................9
4. TOOLS.................................................................................................................................................13
References................................................................................................................................................21

1. Introduction
1.1 Malware
Malware is known as malicious software. It is a software affect to the computer system.
Malware it is a kind of viruses, Trojans, spyware. It works to be steal the protected data or
documents created by the user. And it acts as a spy to cause affect. Spyware is one kind of
malware and it monitor the user location and get through secret data. Adware is another kind of
software it affects in the way of share the information with advertisers and unwanted ads. Worms
and viruses is the special kind of virus to affect entire system. We can use anti-malware software
to provide a prevention to this malware. Firewall is like protection to this malware. And this
malicious software’s works in the function like delete the secret data as well as stealing the data.
1.2 Types of malicious software
 Spyware
 Viruses
 Worm
 Trapdoor
 Logic bomb
 Trojan
 RAT
 Mobile malicious code
 Malicious font
 Rootkit
Spyware
Spyware is one kind of program or software the main aim of this spyware is getting the
information about the person without the vision of user. And whatever information handled by
spyware it upload that in the internet as ad. It can enter into the computer in the way ofinstalling
new software by using pen drives or any other way.
1

Viruses
Virus is a kind of code or some software it can enter the system in the way of copying
another program or it can enter while booting. It can be spread by either email or some new
downloaded file or by the cd or pen drive it can enter in the system.
Worm
Worm also affect the computer system in the way of put duplicate files or create the
duplicate file in that the original document. While the system works are stopped or slowing, it
could be entered.
Logic bomb
Logic bomb is another kind of programming code and it vision is like an executable file.
If some program execution is delayed for some action in the gap this logic bomb entered. It
make delete or corrupt the data.
Trapdoor
Trapdoor is used to getting the access of another system without that system permission
like without knowing the password. Hackers generally using this trapdoor to get the person
details.
Trojan
Trojan is the way of programmable code or software code it can make an affect or
damage in the hard disk. Trojan is part of malicious virus.
RAT
RAT is known as remote admin Trojans it has a remote control to access a machine. And
this is used to get the password and steal the information. And it is invisible to the user and it can
entered via cd or pen drive.
2

Malware
Malware is known as malicious software it affect the computer system and it is in the
forms of worms and viruses.
Mobile malicious code
Its acts like a remote access to get the information and it is look like a web documents it
executes in the web browser.
Malicious font
Webpage that explore the method to describe the font and it acts as a malicious font for
the security.
Rootkits
It acts as a software tool is used as the intruders to get the access of computer knowledge
without the permission of computer. It is called as a rootkit computer and it get through by
variety of operating systems like windows and Linux. In the rootkit it has three types of rootkits
they are kernel rootkit, application rootkit and library rootkit.
2. PART A-Questions and Answers
Social engineering is used for with range of malicious activities it done by human
interaction. It do like user make mistakes and from that getting the information. It first find the
victim of the information used by the security protocols.
Attacking methods
3

This kind of attacking is performed in the human interaction. These has some methods,
 Baiting
 Scare ware
 Pretexting
 Phishing
 Spear phishing
Baiting
It performs in the physical media in the kind of malware. Using this bait the malware gets
automatically into the system. It is speared like online forms.
Scare ware
Scare ware is the fraud software and it act as a good software and vision to the user. It is
known as deception software.
Pretexting
Pretexting works as to get a confirmation about the user data and their data.
Phishing
Phishing is used by the way of email and text message and make a urgent and curiosity.
Spear phishing
Spear phasing is one kind of phasing it requires more effort by done may take two
months.
Preventing methods
4

Social engineering concepts are preventing methods to the malicious software. It has
three techniques to the prevention. First one is did not open the mail and any other files from the
internet and use multi factor authentication and update the anti-virus software often.
After opened that file we known about the attached file with email has malicious or
infected and the infected file with the original document and affected the entire system. By using
anti-virus or prevention method or scanning process we get pure document what is really in the
mail document.
1. Backup and restore the important files what you have in your system.
2. By disconnecting the internet we can stop the download items in your system.
3. And consider the safety measures when booting the system such as anti-virus and
scanning to get the resources.
4. And for the internet get the access from another system through LAN connection for
security and solve malware problems.
5. Analyze the software and find the corresponding solution.
6. Scan the file multiple files what are downloaded from the internet.
7. Maintain the disk as clean and format often.
Security defects
5

Malware has the defects in the creation of operating systems or some other applications.
In the case of installing updated software in that malware make a defect. Malware provide the
executable data after the process execution.
User error
The computer system commonly has floppy disks and operating system, while booting
the operating systems may have changed. Without booting if operating system is installed then it
shows the error in the run time. Many user use the trick to run the software and use the similar
concept in the code so user get the error more times.
Static analysis used to analyze the malware without the use of running it. And this
static analysis used to analyze the capability of the malware and also provide the indicators and
has the key techniques.
Basic static analysis
And this basic static analysis it focus on the malware without the use of the code and rules and it
has various tools and techniques use to check the file is infected or not and it provide the
information such functionally and technical and provide the signatures. In that the technical
analysis tells about the file, hashes and checksums.
And the dynamic analysis about the malware focus on run the malware forgets the
malware behavior and has to observer the functions and analyzes the technical issues used in the
signature detection. Technical issues like domain names and ip address and file location and also
it analyze the attacker who has the control to access the server and that is used for command and
6

control and this is useful to more malware files and the for the dynamic analysis it is used the
sandboxes and malware engines and various tools are used for this dynamic allocation with the
sandboxes.
Virtual machines commonly based on the architectures. And it describes the functionality of the
computer system. Virtual machine is used the combination of software and hardware. It has two
types of virtual machines. They are system and process virtual machines. System virtual machine
give the sub of real machine. And it give the functionality to the whole operating systems. And
the process virtual machines used to execute the programs. Through this virtual machine we can
create multiple operating systems.
Virtual memory has taken a part in virtual machine. In the first level operating system
implementation is done by time sharing. But in the virtual machine it uses the privileged
instructions to the code. It is used to share the memory pages among the similar virtual machine.
Mainly virtual machines used in the embedded systems. In that real operating systems it prefer
the complex such as windows and Linux. Virtual machine has the benefit of operating system by
faster reboot. Next in the process virtual machine it works as an application with single process.
It’s known as application virtual machine and works as platform independent. And it uses the
high level language and it uses the interpreter for this implementation and it uses the java virtual
machine.
VM Detection
A tool competence for malware is to avoid or late investigation. Generally by carry
out one place to move another place malware analysis apprehension along with evasion.When
won, here can considerably development the period malware bottle extend in the wild
unwanted,arrest or refuse.
7

From the analysis of malware it will not execute and not change the behavior and use
some planning to take a fake activities through the virtual machine and in the fake analysis the
malware do not stop their behavior and some malware use fake issues like registry key and
machine for the infection of the file.
Malware often change their code at the same time keep the functionality for keep safe
from detection misuse and embed the malware into the target program and the behavioral of the
malware can destroy the metamorphism. And ANI is a theory explain about the dependencies of
data in the code.
Ip analysis of software
With the use of DNS server attackers can control the machines and the secret
information. DNS is mostly used in the malware protection as control the servers. Normally the
computer system uses the malicious DNS to find the malware. By using analysis of ip can
control the malware in the traffic. Ip address has a feature in this malware detection as well as
DNS server.
Malware detection using ip
8

The DNS has the future behavior of malware detecting activity and malware has occurred
in the form of worms and dots. By using the DNS analyze the complex in the longer network.
Malware infection is another problem during the malware detection.
Constructing the training dataset
Training data set has the important role in the machine learning it is used to train the
classifier and it works as analyze the domains and the malwares. And it is used to predict if the ip
address is affected or not affected by the malware. Domains and control servers are collected as a
training set.
Malicious DNS detector
Tree algorithm is used in the classifier malicious DNS detector and it has proved it is
efficient in classify the malicious domain and these classifier built in the training period. In the
node some attributes must be examined.
Malware configuration
It used to malware and ransom ware creation and it is involved in malware pattern
matching and analyze the secret files that contain malware and used to detect the unwanted
activity and unauthorized activity. And it is used to enable the detection against the malware and
used to backup and restore the ransom ware files and used for the data security.
3. PART B- Questions and Answers
9

In malware there are two types of analysis are available. One is static analysis and
another one dynamic analysis. Static analysis means the malware runs in actual method. Static
analysis means actual analysis and dynamic analysis means behavior analysis. Using dynamic
analysis the executable malwares are controlled and also monitored.
Each and every technique includes some elements of information’s, they are used to
conduct the static analysis.
The actual codes and instructions are displayed by using static analysis. The capabilities
of the malware and true intent of the malware are identified by using the static analysis. Using
this technique the technical indicators are easily detected. In static analysis types of key elements
are used.
The malware behaviors are accepted by the dynamic analysis. Using dynamic analysis
the technical indicators are detect the signature. The basic dynamic analyses are revealed by the
technical indicators. It includes domain names, IP address, and file path location on the system or
network.
The automated sandboxes and malware engines are used to rectify the information’s. The
technical indicators are used to associate the malware detection
10

IDA stands for professional grade dissembler. It’s a most popular disassemble, used in
reverse engineering technique. It’s not support the free community addition. IDA pro 5 is a type
of free community addition.
The code is reconstructed by the popular disassemble. All the codes are in binary form,
so we need to change code in assembler manner. And the executable information’s are used in
assembly code for debug the errors.
The IDA stack analysis have a types of information, these information’s are used in
reverse engineering process. IDA pro script serious is used to share the knowledge’s and also the
tools with the community. It also provides some additional tools like tilib is a special type tool is
used to describe the separate download.
Using this tool the important functions are identified with a name also. The matching
function prototype is used to find the similarities between two functions.
The ransomware always target the following resources like audio, video, images, etc. for
this reason ATC becomes more suspicious. It performs the programs as well as the files also.
First it needs to perform the actions and change the file types
11