Assessment and static analysis¶

Initial assessment determines which tools and analysis methods are needed. This process also helps in the creation of a strategy for analysing the file. This requires carrying out a light static analysis.

Origins¶

Where a file came from shapes what to expect of it. Something recovered from an email attachment was built to survive a mail gateway, and something pulled out of an update channel was built to pass as an update, which is already a claim about the constraints its author worked under. Provenance reads the other way too: whatever the analysis concludes about the channel a sample arrived through is what the same analysis would conclude about a delivery of one’s own.

Existing information¶

Searching the internet for already existing information can be very helpful. There may be existing analyses of the file, which can indicate what behaviours to expect.

Viewing the file and extracting its text strings¶

Using a tool like file helps determine the file type. Extracting readable text from the file with strings also gives hints of what messages, functions, and modules it will use when opened or executed.

File information¶

The file type sets off everything after it. If the file type is a Windows executable, a preset of PE tools will be prepared. If the file type is a Word document, a sandbox environment will have to be installed with Microsoft Office and analysis tools that can read the OLE file format. If the given target for analysis is a website, preparations are likely to involve browser tools that can read HTML and debug Java scripts or Visual Basic scripts.

Static analysis¶

Static analysis helps in making notes of what will be done during dynamic analysis. With knowledge of the assembly language, a disassembled file and its branches can be understood. This allows for preparing the right tools to read, open, and debug the file based on its file type, and understand the file’s structure based on its file format.