Editor’s Note: Published as an independent research paper from the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, Estonia, this new handbook on malware reverse engineering provides important insight into how to analyze malware executables that are targeting the Windows platform.

Authored by Ahmet Balci, Dan Ungureanu, and Jaromir Vondruska from the CCDCOE, this handbook can be considered a solid first step in the investigation of malware and beneficial as a reference for data discovery and legal discovery professionals dealing with the expanding and costly threat of malware.

Taken from the NATO Cooperative Cyber Defence Centre of Excellence

Malware Reverse Engineering Handbook

Handbook Abstract

Malware is a growing threat that causes a considerable cost to individuals, companies, and institutions. Since basic signature-based antivirus defenses are not very useful against recently emerged malware threats or APT attacks, it is essential for an investigator to have the fundamental skill set in order to analyze and mitigate these threats. While specific measures need to be taken for particular cases, this handbook gives an overview of how to analyze malware samples in a closed environment by reverse engineering using static or dynamic malware analysis techniques. The information in this handbook focuses on reverse-engineering fundamentals from the malware perspective, without irrelevant details. Some simple steps and definitions are, therefore, omitted to retain the focus. Resources mentioned in this handbook can be accessed with a simple internet search.

There is no novel work presented in this handbook, as it can be considered as the first steps in investigating malware. The reader will become familiar with the most common open-source toolkits used by investigators around the world when analyzing malware. Notes and best practices are also included. By applying the techniques and tools presented here, an analyst can build Yara rules that can help during the investigation to identify other threats or victims.


Review the Complete Handbook (PDF)

Malware Reverse Engineering Handbook -CCDCOE

Read the original handbook from the CCDCOE


Additional Reading

Source: ComplexDiscovery

The post A Window into Malware? The New Malware Reverse Engineering Handbook from CCDCOE appeared first on ComplexDiscovery.