What is the average time for malware analysis?

Question

I was wondering what is the average time for you to classify (by reverse engineering) if a suspicious file is a malware or not?

Thanks

Answer 1

The question will likely get closed as primarily opinion-based, but I'll give my answer anyway.

If you're just trying to determine if it's likely malicious or not, it can usually be done in less than 5 minutes.

Answer 2

In most cases You don't need RE to identify, if specific sample is "malware" or not. Initial dynamic analysis usually is more than enough to answer the question, if it malware or not.

In cases, where You need to use RE to clarify it category, it depend on mostly 2 factors:

1. Researcher's skill-set and knowledge of methods and techniques to analyse.
2. Ability of malware author to create code, that hard to be detected\reversed\analysed.

But You first of all need to define "malicious activity", and then just look for it in sample.

Answer 3

This is an extremely loaded question and has just as much to do with forensics as it does with reverse engineering. If you're working in a role as a network security analyst and have been tasked with determining whether a binary is malicious, it can be assumed that one of your chief priorities is to identify host-based or network-based signatures. These will be used to help your security admin colleagues detect and eliminate the threat throughout your network. However, unless you're working with a virus from the early 90s, you're not going to find an obvious message like, "WARNING: THIS PROGRAM WILL DESTROY YOUR MACHINE!" in the program's strings.

Anti-RE/debugging/VM and encoding/obfuscation techniques (which are common in modern malware and can extend the time of your analysis considerably) aside, smart malware behaves similarly to legitimate programs and use standard OS APIs to do its work. To reiterate the comment from the user above, you must set a standard on what is considered to be malicious activity.

With all that said, backdoors, keystroke loggers, downloaders, etc. all have unique behavioral indicators. For example, if you run strings on the binary in question and can see a routable IP address, and that IP does not trace back to a legitimate organization, that is a good indication this binary is a reverse shell, and the IP can be used as a network-based signature. This is something that can be done in 2 minutes, but this alone is, by no means, thorough or sufficient.

For more information on malware analysis techniques, I strongly recommend Practical Malware Analysis by Sikorski and Honig.