---
# System prepended metadata

title: Malware analysis

---

# Malware analysis
start: 8:03

## 01 malware
10 minutes
### What is Malware
_what does malware stand for?_

### Malware classification / capabilities
- animations for slide 6

### Botnets
- animations for slide 7

### Modular Malware
- anims (slide 8)

### Cybercrime as a Business
- kinda fast

### Malware Families
- anims (11)
- highlights for quotes

### Aspects of Malware
- anims (14)
- pretty fast

## 2 methods

start: 8:13

### Methods of Malware analysis
- nice slide and animations
- uncle bob cap? ;)

### Reverse Egnineering Insights
- anims (19)
- split into four slides?
- gmail tries the password "infected"
- [Twitter](https://twitter.com/lennyzeltser/status/711188047837138944?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E711188047837138944%7Ctwgr%5E%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fzeltser.com%2Fshare-malware-with-researchers%2F)

### Workflow Malware analysis
- anims (22)

### Workflow Malware analysis
- cool

### Reverse Engineering Rules
- [ida skull :D](https://github.com/xoreaxeaxeax/REpsych) [youtube](https://www.youtube.com/watch?v=HlUe0TUHOIc&t=1715s)

## 03 - Basic static analysis
8:23

- somewhat heavy on bullet points

### Hashes
- size / collision attack

### Antivirus Scanning
- owned by google
- used by authors and analysts alike

### VirusTotal
- Labeling Problem

### Files
- rename to "file"?
- example of a magic value?

### Strings
- static linking
- flags for min-len, encoding, including whitespace and so on
- Why are apinames in the strings?
_which string seems suspicious?_

### PE-Tools
- Warning: Analyzing PE-Files on Windows is somewhat dangerous
- Crop pe-bear screenshot on slide 43

### Packing
- slide 48: It has to be executable anyway - so just let it run

### Advantage / Limitations
- anims (49)

## Dynamic Analysis
start: 8:39

### Dynamic Analysis
- observes one path of execution

### Virtual Machines

### VirtualBox
- bought by Oracle :(
- states make up a tree
- stress host key (maybe give an example on "how to get out?")

### VitualBox Shared Folders
- implemented as an network share

### Mapping a Shared Folder
- I wold likely skip those slides
- (if you have trouble doing it, you can look it up on the slides)

### snapshots
- move to before "VirtualBox"
- anims (60)
- graphic? e.g. ransomware-lockscreen -> back to clean state

### Organize yourself
- anim? (61)
- meaningful snapshot names

### VM detection
- tools somewhat outdated, come back at us if you are interested :)
- I would remove this part

### Golden Rules
- felt pretty rushed
- anims? (64)
_question about golden rules_

### Blackbox Analysis
start: 8:54 (I wasted one minute here - sorry)

### Monitoring

### Process Monitor
- example record / entry?

### blackboxing
- anim (70) (advantages last, disadvantages first?)

### hybrid / Nobrien
- what is that?
- I'd suggest more info or to leave it out

### Methology Matters!
- cool slide
- anims (76)

## 05 Advanced Static Analysis
9:05 (pause was here)
time from start: ~1 hour
after pause: 9:14

### Advanced Static Analysis
- somehow indicate quotes?

### Linear / Stream diassemblers
- basic tools to build recursive ones
- distorm, capstone

### Structual Informaton
- background color :o 
- somewhat overlap with basics
- maybe mention ninja and ghidra there
- cropping?

### Decompiler
- mention its our active research fiekd
- somewhat overlap with basics

### Advanced RE-Tools
- rename to Interactive Disassemblers? [List](https://en.wikibooks.org/wiki/X86_Disassembly/Disassemblers_and_Decompilers)
- some people really love radare to be mentioned
- interactive and recursive are points for all disassemmlers :D
- maybe wirte the versions above the logos (not a bullet point)

## 06 Ghidra
start: 9:22
~ 8 minutes after the break
- maybe upload this part as a seperate slide set and leave it out
- file offset vs virtual memory address?

"see where we are" - minimap
- pretty comprehensive
- structs maybe a little to in-depth

- introduction to debugging was kinda bumpy (what about people don't knowing the term?)

## 07 Advanced Static Analysis
start: 9:34
(normally, the lecture would end around here)

- anims (110)

### Breakpoints
- more graphic example (int 0x3?)
- anims (111)

### Debugger - Maipulation
- graphic? (show manipulation to take a jump, nop a call, etc.)


### x64dbg
start: 9:40

- reminder: what does region/module mean?
- jne vs je ve jmp :)

### Anti-Debugging

- slides looks pretty full
- skip?

### Patching

- cool slide, important stff
- when should you not patch something?

### Takeaway

- where to take notes? (guess its best directly in the debugger)

end: 1:35

# Remarks
- a lot of weak verbs
- quiet fast
- feels driven
- have a look at the next slide before getting to it
- bullet point heavy on some parts
- langugage and speed became much better as you went on :)
- guess we should propably split all lectures into two and take more time