Here are some of the most common mistakes
that I see in, with my students,
and other amateurs
in writing the malware analysis report.
So, the first mistake,
lots of people tend to write the malware story.
Like every single step, here opens this file,
and then he look at the resources,
he copy this file from here to here,
then he rename it, then he does this,
then he does that.
Nobody wants to hear the malware story.
This is really important.
You feel very compelled
to mention how the malware workflow goes.
It does this, then this, then that,
but in most of the malware analysis reports,
that workflow is not that important.
You can dissect this information into different sections
inside the report, let's say the encryption section
and you mention all the different encryption.
And the dropper part and you mention this,
first it drops a resource file
which includes this malware,
and then you mention the persistence,
in the persistence section, the Command & Control,
in the Command & Control section.
And if there's some steps that have to be done
to go into the Command & Control section,
you may mention that it goes
through the Command & Control section
after it does the process injection into a browser,
or something like that.
So, try to not mention the story
and try to dissect it into different parts
and put it in the equivalent section.
This is the first mistake.
The second mistake is that I see,
and this is really, really important part,
because there's a big difference
between a malware analyst and a reverse engineer.
The malware analyst does not just reverse the malware,
he doesn't only see what the malware's doing,
or he writes this file, copy this file,
communicate with this domain, any application can do that,
or any reverse engineer, a skilled reverse engineer,
he can give you all the details about the malware.
But, the malware analyst understands,
what is the meaning of this behavior.
This is very, very important.
So, let's say, a malware and that was in I think, WannaCry,
or, yeah, it was in WannaCry.
(loud whirring sound)
Sorry for that.
So, WannaCry was connecting to a domain,
a completely random domain.
It looks very, very random.
So long, that I don't know, all random, right?
And he checks if actually it was able to connect
to that domain and if it does connect to that domain,
it terminates the malware.
While the malware is doing that,
while it tries to connect to an unknown domain
and checks if this domain is valuable.
Because, in lots of sandbox environments,
or lots of, or with some malware analyst
use an application like FakeNet.
And this application, this sandbox environment,
they create like a kind of fake internet,
fake internet communication.
Every time a malware tries to connect to any domain,
or any IP, it connects back,
it sends him a fake page, or try to make a fake FTP server,
or fake SMTP server,
it tries to always pretend that the service is on.
So it can get the malware to get going
and send some information or request comments
from the attacker, or whatever it wants to do.
But here is the interesting part,
you should not be able to connect to all domains
in the world.
Like in random domain you are able to connect to.
That doesn't happen in normal life, right?
So, the malware tries to connect to a domain
that's not found and if it's found,
he thinks he's in a sandbox environment.
So you need to understand the meaning
of the behavior, and focus on that
when you are writing your report.
This is a very, very important part.
The third thing is that they copy a lot.
And I find that, yeah, there's other reports.
Let's say if you are working in an enterprise company,
let's say Symantec, Kaspersky, FireEye,
there will be cases when there'll be
other reports that have released.
But, you need to do the analysis
and show it from your point of view.
If there is a Yara rule, or like an indication of compromise,
any detection or code where it's for Snort or Yara,
you need to write your own.
You need to learn how to not copy,
but if you feel there's something uncovered
then you have to dig deeper and cover it
and maybe have a catch on your own,
and include screenshots,
or include something that's interesting about it.
That's all about it,
and see you in the next video, bye-bye.