Malware Analysis Techniques

Chapter 4: A Word on Automated Sandboxing

In the last chapter, we discussed utilizing PowerShell to automate some of the common tasks for incident response and triage related to malware. As we learned, utilizing scripting can greatly assist an analyst in collecting pertinent information and making informed decisions quickly.

In this chapter, we'll take those ideas one step further, and examine some of the common fully automated, public, or private malware analysis frameworks that are available to us as analysts and that may speed up our triage even further – without even committing time to scripting for each incident.

We'll examine the IOCs we can collect with a known sample of malware, and then present a challenge at the end of the chapter ...