BC4014 Malware Analysis Syllabus:
BC4014 Malware Analysis Syllabus – Anna University PG Syllabus Regulation 2021
COURSE OBJECTIVES:
To introduce the fundamentals of malware, types and its effects
To enable to identify and analyse various malware types by static analysis
To enable to identify and analyse various malware types by dynamic analysis
To deal with detection, analysis, understanding, controlling, and eradication of malware
UNIT I INTRODUCTIONAND BASIC ANALYSIS
Goals of Malware Analysis, AV Scanning, Hashing, Finding Strings, Packing and Obfuscation, PE file format, Static, Linked Libraries and Functions, Static Analysis tools, Virtual Machines and their usage in malware analysis, Sandboxing, Basic dynamic analysis, Malware execution, Process Monitoring, Viewing processes, Registry snapshots, Creating fake networks
UNIT II ADVANCED STATIC ANALYSIS
X86 Architecture- Main Memory, Instructions, Opcodes and Endianness, Operands, Registers, Simple Instructions, The Stack, Conditionals, Branching, Rep Instructions, Disassembly, Global and local variables, Arithmetic operations, Loops, Function Call Conventions, C Main Method and Offsets. Portable Executable File Format, The PE File Headers and Sections, IDA Pro, Function analysis, Graphing, The Structure of a Virtual Machine, Analyzing Windows programs, Anti-static analysis techniques, obfuscation, packing, metamorphism, polymorphism.
UNIT III ADVANCED DYNAMIC ANALYSIS
Live malware analysis, dead malware analysis, analyzing traces of malware, system calls, api calls, registries, network activities. Anti-dynamic analysis techniques, VM detection techniques, Evasion techniques, , Malware Sandbox, Monitoring with Process Monitor, Packet Sniffing with Wireshark, Kernel vs. User-Mode Debugging, OllyDbg, Breakpoints, Tracing, Exception Handling, Patching
UNIT IV MALWARE FUNCTIONALITY
Downloaders and Launchers, Backdoors, Credential Stealers, Persistence Mechanisms, Handles, Mutexes, Privilege Escalation, Covert malware launching- Launchers, Process Injection, Process Replacement, Hook Injection, Detours, APC injection, YARA rule based detection
UNIT V ANDROID MALWARE ANALYSIS
Android Malware Analysis: Android architecture, App development cycle, APK Tool, APK Inspector, Dex2Jar, JD-GUI, Static and Dynamic Analysis, Case studies,
TOTAL: 45 PERIODS
PRACTICALS:
1. Experimentation on Initial Infection Vectors and Malware Discovery
2. Implementation on Sandboxing Malware and Gathering Information From Runtime Analysis
3. Implementation on Portable Executable (PE32) File Format
4. Implementation on Executable Metadata and Executable Packers
5. Experimentation on Malware Self – Defense, Compression, and Obfuscation Techniques
6. Experimentation on Malware behaviour analysis
7. Experimentation on analyzing Malicious Microsoft Office and Adobe PDF Documents
8. Experimentation on Mobile malware analysis
9. Experimentation on Packing and Unpacking of malware
10. Experimentation on Rootkit Anti Forensics and Covert Channels
11. Experimentation on Modern Rootkit Analysis
12. Experimentation on Malware traffic analysis
Implement of real time applications for the following malware analysis
1. Static analysis of malwares
2. Dynamic analysis of malwares.
3. Classification of malwares based on their behaviour.
4. Usage of tools to classify malware
5. Advanced malware analysis
6. Android malware analysis
7. Applying antivirus tools in various applications
8. Malware report documentation
TOTAL: 30 PERIODS
TOTAL: 45+30=75 PERIODS
COURSE OUTCOMES:
CO1:Understand the various concept of malware analysis and their technologies used.
CO2:Possess the skills necessary to carry out independent analysis of modern malware samples using both static and dynamic analysis techniques
CO3: Understand the methods and techniques used by professional malware analysts
CO4:To be able to safely analyze, debug, and disassemble any malicious software by malware analysis
CO5: Understand the concept of Android malware analysis their architecture, and App development
REFERENCES
1. Michael Sikorski and Andrew Honig, “Practical Malware Analysis” by No Starch Press, 2012,ISBN: 9781593272906
2. Bill Blunden, “The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System”, Second Edition, Jones & Bartlett Publishers, 2009.
3. Jamie Butler and Greg Hoglund, “Rootkits: Subverting the Windows Kernel” by 2005, Addison-Wesley Professional, ISBN:978-0-321-29431-9
4. Bruce Dang, Alexandre Gazet, Elias Bachaalany, Sébastien Josse, “Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation”, 2014, ISBN: 978-1-118-78731-1
5. Victor Marak, “Windows Malware Analysis Essentials” Packt Publishing, O’Reilly, 2015, ISBN: 9781785281518
6. Ken Dunham, Shane Hartman, Manu Quintans, Jose Andre Morales, Tim Strazzere, “Android Malware and Analysis”, CRC Press, Taylor & Francis Group, 2015, ISBN: 9781482252194
7. Windows Malware Analysis Essentials by Victor Marak, Packt Publishing, 2015