
defense And AnAlysis teChniques 287
5.4.1 Passive Analysis
Passive analysis is the hands-off approach to behavioral malicious code
analysis. All it requires is a computer to infect, some way to capture
the state of that computer, and a way to restore the system to its origi-
nal state. Passive analysis systems work in the three-stage cycle shown
in Exhibit 5-6. First, someone installs the operating system and any
necessary applications on a computer, recording the “clean” state. e
recorded information includes any features of the system that mali-
cious code might alter, such as the file system and Windows registry.
Second, the malicious code ...