Overview of malicious code analysis process

Code Analysis Process

1. Examine static properties of the Windows executable for initial assessment and triage.
2. Identify strings and API calls that highlight the program’s suspicious or malicious capabilities.
3. Perform automated and manual behavioral analysis to gather additional details.
4. If relevant, supplement our understanding by using memory forensics techniques.
5. Use a disassembler for static analysis to examine code that references risky strings and API calls.
6. Use a debugger for dynamic analysis to examine how risky strings and API calls are used.
7. If appropriate, unpack the code and its artifacts.
8. As your understanding of the code increases, add comments, labels; rename functions, variables.
9. Progress to examine the code that references or depends upon the code you’ve already analyzed.
10. Repeat steps 5-9 above as necessary (the order may vary) until analysis objectives are met.