Digital Forensics and Incident Response

Static analysis

Static Analysis is an examination of the actual malware code without executing it on a system. For malware researches, the code may be obtained from systems that are left out to be deliberately infected or from production systems that have been impacted by the malware.

In this case, incident response analysts can obtain the actual source code or executable through a combination of memory analysis and acquiring the actual executable during an analysis of the hard drive. Static analysis is often comprised of several different techniques:

• Fingerprinting: One of the most basic techniques is obtaining a cryptographical hash of the code.These hashes can then be compared to other known hashes to determine if the code has been seen ...