4

In other words, Is it safe to load a malware into IDA Pro on my personal machine? Would IDA Pro run the sample or load it into memory?

Improve this question

1 Answer 1

Reset to default
6

At first, it is always recommended to analyze viruses inside an Isolated environment. So, you could install IDA Pro in a Virtualized Environment such as VMWare Work Station and load the binary in IDA Pro.

IDA Pro by default will only perform disassembly of the binary. It means, static analysis or in other words, the code of the binary won't be executed.

However, there are several scenarios to consider while analyzing malicious binaries with IDA Pro:

  1. The binary could exploit an unknown vulnerability in IDA Pro in such a way that when it is loaded by IDA Pro, the malicious code can execute. I haven't seen such a vulnerability yet however we must consider it while analyzing malicious binaries.

  2. If you are using IDA Pro for debugging the binary, then it means the code will execute and so you should perform the analysis in a virtualized environment.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.