First.
Malicious code analysis target
1. Based on the host's feature code, used to detect malicious code on the infected host
2. Network feature codes, detect malicious codes by monitoring network traffic
Second. Types of
malicious code
back door
Botnet
Downloader
Spyware
Launcher
Kernel kit
Ransomware
Malicious code for sending spam
Worms or computer viruses
Third. Malicious code analysis technology
1. Basic technology of static analysis
Static analysis tools:
Use the PEiD shell search tool to detect the type of packer, or the type of compiler used to link the application.
Use the Dependency Walker tool to explore dynamic link functions.
Use PEview to analyze PE files.
Use the Resource Hacker tool to view the resource section.
2. Basic technology of dynamic analysis
Sandbox: Use malicious code sandbox, such as Norman sandbox and GFI sandbox.
Run malicious code: Run DLL: rundll32.exe program is included in all windows versions.
Syntax format: rundll32.exe DLLname, Export arguments
</br>Export value must be the function name or serial number in the exported function table of a DLL file.
3. Advanced technology of static analysis
4. Advanced technology of dynamic analysis
