Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Where can I get info with a view to classify malware based on actions performed by the them. Eg. modifying registry files, copying themselves into other executable's etc.

share|improve this question
add comment

closed as too broad by Scott Pack, Gilles, Xander, AviD Nov 25 '13 at 15:41

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

5 Answers

If you mean how to automatically classify malware, this paper on Learning and Classification of Malware Behavior (Meta data) can be of help.

share|improve this answer
add comment

A good site, formerly known as cwsandbox.org is now called mwanalysis.org. Just submit a sample and it generates a behavioral report. HTH.

share|improve this answer
add comment

For file and registry accesses, run it in a VM with Process Monitor running or upload it to here.

share|improve this answer
add comment

enter the Malware name here Threat Expert and you will get a lot of useful info about that Malware

share|improve this answer
add comment

you can use any API hooking application. Depends on which Ring that you want to hook.

Or Viking enough, write your own hook program.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.