Transform a suspicious sample in operational information.
Malware analysis helps determine what a file does, what changes it makes, how it communicates, and what persistence mechanisms it uses. The results support incident response, threat hunting and the creation of detection rules.
Levels of analysis
- initial triage, hashing and format identification;
- static analysis of strings, imports, sections and indicators;
- dynamic execution in a controlled environment;
- observation of processes, files, registry and communications;
- assessment of persistence, avoidance and movement capacity;
- targeted reverse engineering, when necessary and foreseen by the scope.
Operational outputs
- description of the behavior and abilities observed;
- hashes, domains, IP, path, mutex and other indicators;
- artifacts to search on endpoints and logs;
- containment and remediation recommendations;
- elements for EDR/XDR, SIEM, IDS or YARA rules, if applicable;
- limits of the analysis and possible techniques not activated in the laboratory.
Samples are processed in isolated environments and according to defined procedures. No conclusions are extended beyond what the evidence allows to demonstrate.