2

I don't know much about malware analysis so why this question here.

I have analysed Short cut virus statistically and its impact on USB drives and wrote a code to repair its damage.

My static analysis of this malware on USB drives:

  1. It does creates shortcuts for all folders and files present in my removable.

  2. In order to infect the computer it does modifies the autorun.inf file and thereby infects the PC when removable drive is plugged in.

I analysed this statistically without executing anything.(I mean just analyzing the removable drive)

So in order to solve these issues I wrote a small piece of code to iterete over the drive to find shortcuts and fixing the attributes.

here is a piece of code,

int ShortCutVirusKiller::FixAttributes(wchar_t buffer[10])
{
    PWSTR show = L"/c attrib -s -r -h *.* /s /d /l ";
    ShellExecute(NULL, L"open", L"cmd.exe", show, buffer, SW_HIDE);
    return 0;
}

The above code is a member function of my class for fixing the attributes the variable buffer is nothing but the removable drive letter e.g H:\

I used several iteration techniques to dive through the drive fixes the auto-run problem of USB drive.

This of-course fixes the problem of the USB drive But shortcut virus does infects the computer modifying the start-up and registery[I referred this in internet]

So here is my question: I want to see what does it change actually so I want to analyse the malware dynamically. Static malware analysis will not help here I am sure of it.

To analyse the malware I need to set up an environment suitable for anaysis.

I came to know about virtual machines like VMWare will do that. I have no problem with that but some suggest Linux is the best OS for analyzing malware. Since this malware modifies the registry entry and start-up I am quiet confused which operating system to install.

To analyse Malware which affects the windows platform I think I should install windows or should I install linux or something.

I am new to this field I don't have any previous experience on analyzing malware dyanamically so please don't be rude.

I do have all tools to analyse the malware statistically.

Thank you

  • 1
    Lookup Cuckoo Sandbox, it's a really good sandbox for malware analysis. Unless you want to create something "New". – mike-stokkel Mar 17 '16 at 16:27
  • Quick search on Google says that it is used to analyze known malware since it is automated. Since it is a sandbox it will not affect other files right? and can be done safely in Windows.? Thank you – VISWESWARAN NAGASIVAM Mar 17 '16 at 16:42
  • 1
    Have you already looked at malwr.com ? Example of analysis here: malwr.com/analysis/ZWYwMzYwZGUxZjRhNDU0OWJhNDc3YTg3OGNhZjM0Mzc – pureooze Mar 18 '16 at 2:30
  • @UzSh I know about malware.lu but this is new. The link provided by you, Is that a report for shortcut virus? Thank you for your help – VISWESWARAN NAGASIVAM Mar 18 '16 at 6:04
  • 1
    Well that's really up for you to decide but you can always sign up using a temporary email address and fake information. You can upload a file and they will analyze it for you and tell you what files and registry keys it accesses. – pureooze Mar 18 '16 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.