Automatic Malware Analysis Michael Boman, Security Guy, Sweden http://michaelboman.org

Michael Boman, Security Guy, Sweden

http://michaelboman.org

Agenda Scenario Solutions Questions & Answers

Scenario

Solutions

Questions & Answers

Scenario Want to determine if a suspect file is malicious

Want to determine if a suspect file is malicious

Solutions Scan it with one or more anti-malware softwares Run it in a virtual/air-gapped system Both approaches requires a infrastructure (system with required tools + knowledge), which more organizations doesn't have readable available

Scan it with one or more anti-malware softwares

Run it in a virtual/air-gapped system

Both approaches requires a infrastructure (system with required tools + knowledge), which more organizations doesn't have readable available

VirusTotal Scans uploaded files with 39 different antivirus engines at once

Scans uploaded files with 39 different antivirus engines at once

CWSandBox Run the uploaded file in a virtual windows environment Tracks File and Registry operations Program execution Network operations

Run the uploaded file in a virtual windows environment

Tracks

File and Registry operations

Program execution

Network operations

Norman Sandbox Run the uploaded file in a virtual windows environment Tracks File and Registry operations Program execution Network operations

Run the uploaded file in a virtual windows environment

Tracks

File and Registry operations

Program execution

Network operations

Question & Answers

Thank you!