This project demonstrates both static and dynamic malware analysis techniques within an isolated virtual lab environment.
The objective was to safely analyse malware samples using reverse engineering, behavioural analysis and network monitoring tools while documenting indicators of compromise (IOCs), persistence mechanisms and malware behaviour.
The analysis was performed inside an isolated virtual environment using:
- Kali Linux
- Windows Virtual Machine
- VirtualBox
- Host-Only Networking
- Ghidra
- x64dbg
- dnSpy
- Wireshark
- INetSim
- Process Monitor
- Process Explorer
- Regshot
- PEStudio
The static analysis focused on:
- PE file inspection
- String extraction
- Import analysis
- Hash generation
- Reverse engineering
- Suspicious Windows API identification
The dynamic analysis included:
- Process monitoring
- Registry monitoring
- File system activity
- Network traffic analysis
- DNS requests
- HTTP communications
- Malware persistence
- Runtime behaviour analysis
Breakpoints were placed on several Windows API functions, including:
FreeConsoleGetAdaptersInfogethostnameIsDebuggerPresent
The FreeConsole breakpoint was successfully triggered during execution, confirming that the Windows API identified during static analysis was also executed at runtime.
The malware sample was executed inside an isolated virtual environment while INetSim simulated internet services.
Wireshark captured an HTTP GET request sent to the simulated domain ziarat-helpdesk.com, demonstrating the malware attempting to communicate with a remote server.
The captured TCP stream revealed parameters containing the machine name, active window title and clipboard information, demonstrating attempted data exfiltration within the isolated laboratory.
Process Monitor was used to observe system activity during malware execution.
The captured events show the malware performing a CreateFile operation followed by CreateFileMapping, demonstrating that the executable was opened and mapped into memory with executable permissions.
- Static Malware Analysis
- Dynamic Malware Analysis
- Reverse Engineering
- Windows API Analysis
- Network Traffic Analysis
- Process Monitoring
- Threat Detection
- Malware Behaviour Analysis
- Incident Investigation
📄 View the full report:
Static_and_Dynamic_Malware_Analysis_Report.pdf
This project was completed as part of a university module using malware samples analysed within an isolated virtual laboratory.