Hands-On Artificial Intelligence for Cybersecurity

Static malware analysis

The first step in malware analysis begins with the evaluation of the presence of suspect artifacts in binary files, without actually running (executing) the code.

The complexity of techniques used in this phase goes under the name of static malware analysis.

Static malware analysis consists of the following:

• Identifying the objectives considered of interest for the analysis
• Understanding the flow of executable instructions
• Identifying known patterns and associating them to possible malware (also known as malware detection)

To this end, analysis tools and procedures are used in order to perform the following functions:

• Identifying calls to system APIs
• Decoding and manipulating string data for obtaining sensitive ...