Which tool should be used for dynamic malware analysis?

Dynamic malware analysis involves executing the malware in a controlled, isolated environment to observe its behavior in real-time. A sandbox is a security mechanism specifically designed for this purpose. It allows analysts to safely run suspicious code and monitor its actions, such as file system modifications, registry changes, process creation, and network communications, without risk to the host system or network. This behavioral analysis is the core of the dynamic approach.

A. Decompiler: This is a static analysis tool used to translate compiled, low-level machine code back into a higher-level programming language, allowing for code review without execution.
B. Unpacker: This is a utility used during the preparatory phase of static analysis to reverse the compression or obfuscation applied to malware, revealing its original code for examination.
C. Disassembler: This is a fundamental static analysis tool that converts machine code into human-readable assembly language, enabling an analyst to inspect the program's instructions without running it. ---

1. Cisco Systems

Inc.

"Cisco Secure Malware Analytics (Threat Grid) Data Sheet". Cisco.com. Accessed 2023. In the "Product overview" section

it states: "Cisco Secure Malware Analytics is a cloud-based malware analysis and threat intelligence platform. It combines static and dynamic malware analysis with threat intelligence into one solution." It further details that the dynamic analysis occurs within its sandbox environment to observe malware behavior.

2. Sikorski

M.

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. In Chapter 1

"Basic Analysis

" the text clearly distinguishes between static and dynamic analysis techniques. Sandboxes are presented as a primary tool for automated dynamic analysis (p. 15)

while disassemblers and decompilers are categorized under static analysis tools (p. 14).

3. Egele

M.

Scholte

T.

Kirda

E.

& Kruegel

C. (2008). "A survey on automated dynamic malware analysis techniques and tools." ACM Computing Surveys (CSUR)

44(2)

1-42. Section 2

"Dynamic Analysis

" defines the process: "The basic idea of dynamic analysis is to execute the malware in a safe environment and monitor its actions... Such a controlled environment is often called a sandbox." (p. 6:3). https://doi.org/10.1145/2089125.2089126