Digital Forensics and Incident Response - Second Edition

Static analysis

Static analysis is an examination of the actual malware code without executing it on a system. For malware researchers, the code may be obtained from systems that are left out to be deliberately infected, or from production systems that have been impacted by the malware.

In this case, incident response analysts can obtain the actual source code or executable through a combination of memory analysis and acquiring the actual executable during an analysis of the hard drive. Static analysis often comprises several different techniques, as follows:

• Fingerprinting: One of the most basic techniques is obtaining a cryptographical hash of the code. These hashes can then be compared to other known hashes, to determine if the code has ...