Malware analysis

Malware analysis is the study or process of determining the functionality, origin and potential impact of a given malware sample, such as a virus, worm, Tojan horse, rrootkitor backdoor. [1]. Malware, or malicious software, is any computer software intended to harm the host operating system or to steal sensitive data from users, organizations or companies. Malware may include software that gathers user information without permission. It supports incident response by helping investigators identify infections, assess their consequences and plan containment and recovery.

Two principal approaches are static analysis, which examines a program without executing it, and dynamic analysis, which observes it during execution. These approaches provide different kinds of evidence and have different limitations.

Analysis may also include memory forensics and manual reverse engineering. Findings can describe a sample's capabilities, its dependencies and the evidence used to identify it, together with indicators and detection rules that support further investigation.