Skip to Main Content
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
book

Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

by Michael Hale Ligh, Steven Adair, Blake Hartstein, Matthew Richard
November 2010
Intermediate to advanced content levelIntermediate to advanced
744 pages
17h 18m
English
Wiley
Content preview from Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

Chapter 3. Malware Classification

One of the most common tasks malware analysts perform is initial triage, or classification of unknown content. Classification ranges from the simple, as in detecting the type of file, to the more complex, such as detecting the percent similarity with other samples in the wild and determining which behaviors are shared between variants of the same malware.

This chapter shows how to use various free and open source tools such as ClamAV and YARA to quickly identify and classify malware. There are a number of companion Python scripts in this chapter for converting from one signature format to another, scanning files with multiple antivirus products, creating your own heuristic-based malicious file detector, and so on.

Classification with ClamAV

ClamAV is an open source antivirus engine owned by Sourcefire, the makers of the Snort intrusion-detection engine. ClamAV offers a fast and flexible framework for detecting malicious code and artifacts. The uses for ClamAV include incident response, forensics, and general malware protection or malware discovery. You can also use ClamAV to supplement or replace existing antivirus scanners on desktops, file servers, mail servers, and other places you might use an antivirus scanner.

ClamAV has a number of built-in scanning capabilities for handling archive files, packed executables, HTML, mail, and other data types. This functionality allows you to write signatures and scan a broad range of content without writing specific ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Hacking Exposed Malware & Rootkits: Security Secrets and Solutions, Second Edition, 2nd Edition

Hacking Exposed Malware & Rootkits: Security Secrets and Solutions, Second Edition, 2nd Edition

Christopher C. Elisan, Michael A. Davis, Sean M. Bodmer, Aaron LeMasters
Malware Forensics Field Guide for Linux Systems

Malware Forensics Field Guide for Linux Systems

Eoghan Casey, Cameron H. Malin, James M. Aquilina
The Basics of Cyber Safety

The Basics of Cyber Safety

John Sammons, Michael Cross

Publisher Resources

ISBN: 9780470613030Purchase book