Malware Analysis Lecture Flashcards

Vocabulary flashcards generated from the lecture transcript covering malware fundamentals, static and dynamic analysis techniques, disassembly, decompilation tools like Ghidra, and endpoint security mechanisms.

Malware

Software used to perform unauthorized actions that benefit an attacker and often harm the primary user, such as reading, encrypting, deleting, or transmitting data.

Persistence

A MITRE ATT&CK category referring to mechanisms used by attackers to maintain access across system reboots, such as installing a backdoor.

Privilege Escalation

The process of transitioning from a low-privilege local user account to an account with higher system privileges, such as an admin account.

Command and Control

The infrastructure used by attackers to communicate with malware and issue remote commands on an infected machine.

Ransomware

A type of malware that encrypts local system files and extorts the victim through threats to pay a ransom.

Malware Analysis

The process of uncovering what a piece of software actually does, beyond its superficial claims or obfuscated behaviors.

Static Analysis

A malware analysis approach that inspects the program binary, files, or inferred source code without executing the software.

Dynamic Analysis

A malware analysis technique that involves executing software in a safe, controlled environment (such as a virtual machine) to observe runtime behavior.

Obfuscation

A class of techniques designed to hide a program's true functionality and make analysis difficult for security researchers.

Disassembly

An advanced static analysis technique where a software tool converts raw binary bytes back into assembly language code.

Decompilation

The process of taking a disassembled program binary and inferring high-level, C-like pseudo code.

Debugger

An advanced dynamic analysis tool that provides surgical, step-by-step control over program execution and memory states.

Ghidra

An open-source reverse engineering and disassembly tool developed by the National Security Agency (NSA).

IDA Pro

A popular proprietary, closed-source reverse engineering and disassembly software tool.

TextProc

A pseudo-malicious command-line demonstration program that normalizes text while covertly logging input data and exfiltrating contents containing specific keywords.

Format Specifiers

Placeholder characters (such as percent signs in C functions like sprintf) that are substituted with variable values sequentially from left to right.

XOR Obfuscation

A simple technique using bitwise XOR operations to scramble and conceal strings or hosts within a binary.

CyberChef

A web-based data analysis tool used during the lecture to decode XOR-encoded strings using a specific key.

EDR

Endpoint Detection and Response; software running on the host that monitors process execution, file access, and child processes while enabling remote incident response.

NDR

Network Detection and Response; security technology that uses machine learning to monitor network traffic and identify threat actor behaviors.

Microsoft Defender XDR

A security platform that correlates detections across Microsoft 365, Defender Antivirus, and EDR into a unified view.