|
|
Content Assessment: CCDCOE Malware Reverse Engineering Handbook
Information - 95%
Insight - 95%
Relevance - 95%
Objectivity - 100%
Authority - 100%
97%
Excellent
A short percentage-based assessment of the qualitative benefit of the recent post sharing the CCDCOE Handbook on Malware Reverse Engineering.
Editor’s Note: Published as an independent research paper from the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, Estonia, this new handbook on malware reverse engineering provides important insight into how to analyze malware executables that are targeting the Windows platform.
Authored by Ahmet Balci, Dan Ungureanu, and Jaromir Vondruska from the CCDCOE, this handbook can be considered a solid first step in the investigation of malware and beneficial as a reference for data discovery and legal discovery professionals dealing with the expanding and costly threat of malware.
Taken from the NATO Cooperative Cyber Defence Centre of Excellence
Malware Reverse Engineering Handbook
Handbook Abstract
Malware is a growing threat that causes a considerable cost to individuals, companies, and institutions. Since basic signature-based antivirus defenses are not very useful against recently emerged malware threats or APT attacks, it is essential for an investigator to have the fundamental skill set in order to analyze and mitigate these threats. While specific measures need to be taken for particular cases, this handbook gives an overview of how to analyze malware samples in a closed environment by reverse engineering using static or dynamic malware analysis techniques. The information in this handbook focuses on reverse-engineering fundamentals from the malware perspective, without irrelevant details. Some simple steps and definitions are, therefore, omitted to retain the focus. Resources mentioned in this handbook can be accessed with a simple internet search.
There is no novel work presented in this handbook, as it can be considered as the first steps in investigating malware. The reader will become familiar with the most common open-source toolkits used by investigators around the world when analyzing malware. Notes and best practices are also included. By applying the techniques and tools presented here, an analyst can build Yara rules that can help during the investigation to identify other threats or victims.
Review the Complete Handbook (PDF)
Malware Reverse Engineering Handbook -CCDCOERead the original handbook from the CCDCOE
Additional Reading
- The Intersection of International Law and Cyber Operations: An Interactive Cyber Law Toolkit
- Estonia and the United States to Build a Joint Cyber Threat Intelligence Platform
Source: ComplexDiscovery
