🦠 Malware Analysis & Reverse Engineering — Playbook: Static, Dynamic, dan Memory Analysis

Panduan komprehensif analisis malware dan reverse engineering — dari triage cepat dan static analysis, sandbox dynamic analysis, memory forensics (Volatility), hingga binary instrumentation (Frida, Unicorn). Mencakup analisis PE (Portable Executable) dan ELF (Executable and Linkable Format), packing/unpacking detection, YARA rule authoring, serta incident-response triage menggunakan FLOSS, CAPA, dan IDA Pro/Ghidra workflow.

Hubungan ke Vault

Nota ini terkait dengan firmware-reverse-engineering-deepdive untuk RE tingkat firmware/hardware, endpoint-detection-playbook untuk triage forensik di host yang mungkin terinfeksi, blueteam-detection-matrix untuk deteksi behavioral malware, comprehensive-threat-directory untuk taksonomi jenis malware, ebpf-kernel-security dan ebpf-beyond-security untuk kernel-level detection of malware behavior, serta incident-response-framework untuk konteks IR yang lebih luas.

---

Daftar Isi

• Foundation
• Technical Deep-Dive
• Advanced
• Case Studies
• Koneksi ke Vault
• References

---

Foundation

Tingkat Analisis Malware

Level	Tujuan	Alat	Kecepatan	Kedalaman
L0 — Triage	Determine: malicious? family? IoC?	VirusTotal, Hybrid Analysis, YARA, CAPA	⚡ (5-10 menit)	Dangkal
L1 — Static Analysis	Extract strings, imports, exports, sections, metadata tanpa eksekusi	PEStudio, Detect It Easy (DiE), strings, FLOSS, Ghidra	⚡⚡ (15-30 menit)	Medium
L2 — Dynamic Analysis	Observe behavior in sandbox: network, filesystem, registry, process	Cuckoo Sandbox, CAPE, ANY.RUN, ProcMon, Wireshark	⏱️ (30-60 menit)	Medium-High
L3 — Memory Analysis	Dump dan analisis RAM untuk malware artifacts	Volatility 3, Rekall, LiME, winpmem	⏱️⏱️ (1-2 jam)	High
L4 — Full Reverse Engineering	Disassemble → decompile → understand full logic	IDA Pro, Ghidra, Binary Ninja, x64dbg, GDB	🧠 (hari-minggu)	Full

Kapan berhenti? Jika tujuan adalah incident response, L0–L2 sudah cukup untuk containment dan remediation. Full RE (L4) diperlukan jika malware adalah zero-day, APT tool, atau butuh custom signature untuk EDR.

Format File — PE vs ELF vs Mach-O

Fitur	PE (Windows)	ELF (Linux)	Mach-O (macOS)
Struktur	DOS Header → PE Header → Section Headers → Sections	ELF Header → Program Headers → Section Headers → Sections	Mach-O Header → Load Commands → Segments/Sections
Entry point	AddressOfEntryPoint (relatif ke ImageBase)	e_entry (virtual address)	LC_MAIN load command
Imports	IMAGE_DIRECTORY_ENTRY_IMPORT (IAT)	.dynsym + .dynstr sections	LC_DYLD_INFO
Exports	IMAGE_DIRECTORY_ENTRY_EXPORT (EAT)	.dynsym (STB_GLOBAL)	LC_DYLD_INFO (export trie)
Sections umum	.text, .data, .rdata, .rsrc, .reloc	.text, .data, .bss, .rodata, .plt, .got	__TEXT, __DATA, __LINKEDIT
ASLR	/DYNAMICBASE linker option	-pie compiler flag	Default (PIE mandatory since 10.7)

---

Technical Deep-Dive

L0 — Triage Cepat

VirusTotal Automation (CLI)

# Submit file
curl -X POST "https://www.virustotal.com/api/v3/files" \
  -H "x-apikey: $VT_API_KEY" \
  -F "file=@sample.exe"
 
# Check hash
curl -X GET "https://www.virustotal.com/api/v3/files/$HASH" \
  -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats'

YARA First Pass — Rule Authoring

rule APT_Malware_Generic {
    meta:
        description = "Generic APT malware detection — mutex + API patterns"
        author = "SOC Team"
        date = "2026-07-15"
        hash = "a1b2c3d4..."
    strings:
        // Mutex names (common APT families)
        $m1 = "Global\\{457224D0-1B01-11D3-BC1D-0090271B6B21}" ascii wide
        $m2 = "Global\\Mutex_MSWinUpdate" ascii wide
 
        // Suspicious API sequences
        $a1 = "VirtualAllocEx" ascii fullword
        $a2 = "WriteProcessMemory" ascii fullword
        $a3 = "CreateRemoteThread" ascii fullword
 
        // C2 indicators
        $c1 = "http://" ascii
        $c2 = "Command=" ascii
        $c3 = "&id=" ascii
    condition:
        (1 of ($m*)) and (2 of ($a*)) and (any of ($c*))
}
 
rule UPX_Packed {
    meta:
        description = "UPX packed executable"
    strings:
        $upx = "UPX!" ascii
        $upx0 = "UPX0" ascii
        $upx1 = "UPX1" ascii
    condition:
        $upx at 0 and ($upx0 or $upx1)
}

CAPA — Automatic Malware Capability Detection

CAPA (FireEye/Mandiant) mendeteksi kemampuan malware dari binary tanpa perlu eksekusi:

# Install
pip install flare-capa
 
# Run
capa sample.exe -j > capabilities.json
 
# Output sample
┌──────────────────────────────┐
│ CAPA v7.0 — sample.exe       │
│ MD5: a1b2c3...               │
├──────────────────────────────┤
│ ATT&CK Tactic: Execution     │
│   - T1059 Command & Scripting│
│ ATT&CK Tactic: Defense Evasion │
│   - T1027 Obfuscated Files   │
│   - T1140 Deobfuscate/Decode │
│ MBC Method: Process::Create  │
│   - CreateProcess API        │
│ Networking                   │
│   - HTTP communication       │
│   - Encode data with Base64  │
│ Persistence                  │
│   - Registry Run Key         │
└──────────────────────────────┘

L1 — Static Analysis

PE File Structure

┌──────────────────────┐
│ DOS Header           │ ← "MZ" magic, e_lfanew offset
├──────────────────────┤
│ DOS Stub             │ ← "This program cannot be run in DOS mode"
├──────────────────────┤
│ PE Header (NT Header)│
│  ├─ Signature        │ ← "PE\\0\\0"
│  ├─ File Header      │ ← machine, sections, timestamp, symbol info
│  └─ Optional Header  │ ← entry point, image base, subsystem, DLL characteristics
├──────────────────────┤
│ Section Headers      │ ← .text, .data, .rdata, .rsrc, .reloc
├──────────────────────┤
│ Sections (raw data)  │
└──────────────────────┘

Anomali PE yang patut dicurigai:

Anomali	Deskripsi	Tingkat Kecurigaan
SizeOfHeaders abnormal	> 0x1000 — kemungkinan overlay data	🟡 Medium
Section name aneh	.abc, .zdata, ..text — bukan nama standar	🟡 Medium
Section RawSize ≠ VirtualSize	Packer atau custom loader — data terkompresi	🔴 High
EntryPoint di section non-.text	Code execution dari .data atau .rdata	🔴 High
Subsystem = IMAGE_SUBSYSTEM_NATIVE	Driver atau bootkit	🔴 High
DLL Characteristics = IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE	Normal untuk legitimate — tapi banyak juga malware yang enable	🟢 Low
Rich Header aneh	Padding anomali — bisa mengandung kompiler fingerprint	🟡 Medium
Many sections (>12)	Legit bisa, tetapi umum pada packer	🟡 Medium
Import Address Table kosong	Resolved at runtime — dynamic loading	🔴 High

FLOSS — FireEye Labs Obfuscated String Solver

FLOSS mengekstrak string yang di-decode/de-obfuscate secara statis (tanpa eksekusi):

floss sample.exe --output floss-results.txt

Mendukung: stack strings, tight strings, decoded strings dari function arguments. Hasil:

-------------------
| FLOSS RESULTS    |
-------------------
Decoded Strings:
  - "http://malware-c2.example.com/gate.php"
  - "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
  - "Software\\Microsoft\\Windows\\CurrentVersion\\Run"
  - "C:\\Users\\Public\\svchost.exe"
  - "x86_64-linux-gnu.so"   [suspicious — Windows binary with Linux string]
Stack Strings:
  - "WinExec"
  - "URLDownloadToFileA"
  - "CreateToolhelp32Snapshot" [process enumeration]
  - "OpenProcess"
  - "VirtualAllocEx"

Ghidra / IDA Workflow — Dasar

1. Load binary → Select loader (PE/ELF)
2. Auto-analysis → Wait for initial decompilation
3. Check entry point function (usually `start` or `entry`)
4. Identify main function (follow reference from entry)
5. Rename key variables and functions
6. Look for:
   - URL/domain strings → C2 indicators
   - Decryption loops → XOR, RC4, AES
   - Process injection APIs → CreateRemoteThread, NtCreateThreadEx
   - COM object creation → persistence or lateral movement
7. Create custom structs for configuration data
8. Export pseudo-code + notes → write report

L2 — Dynamic Analysis (Sandbox)

Cuckoo Sandbox / CAPE Setup Minimal

CAPE (Cuckoo Augmented PE) — fork aktif dari Cuckoo:

# Install (Ubuntu 22.04)
sudo apt-get install python3-pip postgresql tcpdump genisoimage
git clone https://github.com/kevoreilly/CAPE/
cd CAPE
pip3 install -r requirements.txt
python3 cuckoo.py initdb
# Start
python3 cuckoo.py --debug

Untuk IR cepat — menggunakan ANY.RUN atau Joe Sandbox online:

# Submit ke ANY.RUN via API
curl -X POST "https://api.any.run/v1/analysis" \
  -H "Authorization: Bearer $ANY_RUN_KEY" \
  -F "file=@sample.exe" \
  -F "env_os=windows-10" \
  -F "env_bitness=64"

Analisis Sandbox — Yang Harus Diperhatikan

Aspek	Indikator Malware	Tool/Catatan
Process tree	rundll32.exe spawns powershell.exe → cmd.exe → svchost.exe	Process Hacker, ProcMon
Network	DNS query to DGA domain, HTTP POST to /gate.php, C2 beacon interval	Wireshark, FakeNet, INetSim
Registry	Run key write, AppInit_DLLs modification, service creation	ProcMon, RegShot
Filesystem	Drop file to %TEMP%, create hidden file, modify hosts file	FileSystem Scanner, ProcMon
Named pipes	Create named pipe for IPC (keylogger, backconnect)	PipeList, Sysmon Event 17/18
Mutex	Create unique mutex — bisa jadi [1] single-instance guard, [2] family fingerprint	Handle, Process Explorer
Injection	WriteProcessMemory + CreateRemoteThread ke explorer.exe atau svchost.exe	API Monitor, Sysmon Event 8/10
Anti-VM	Query SELECT * FROM Win32_ComputerSystem → check Model = “VirtualBox”	Wireshark + ProcMon

InetSim — Fake Network Services untuk Dynamic Analysis

# Install
sudo apt install inetsim
# Config: /etc/inetsim/inetsim.conf
start_service dns,http,https,smtp,pop3,imap,ftp,tftp,irc,nntp
# Run
sudo inetsim

---

Advanced

Memory Forensics dengan Volatility 3

Volatility 3 adalah framework memory analysis open-source. Tidak lagi memerlukan profile — auto-detect OS.

# Install
pip3 install volatility3
 
# Dapatkan memory dump (dari host yang dicurigai terinfeksi)
# Windows: winpmem (https://github.com/Velocidex/WinPmem)
winpmem_mini_x64_rc2.exe mem.dmp
 
# Linux: LiME (https://github.com/504ensicsLabs/LiME)
insmod lime.ko "path=mem.dmp format=lime"
 
# Dasar Volatility 3
vol -f mem.dmp windows.pslist.PsList
vol -f mem.dmp windows.psscan.PsScan     # hidden/unlinked processes
vol -f mem.dmp windows.netscan.NetScan   # network connections
vol -f mem.dmp windows.dlllist.DllList   # loaded DLLs per process
vol -f mem.dmp windows.cmdline.CmdLine   # command line arguments
vol -f mem.dmp windows.filescan.FileScan # file handles

Proses Mencurigakan — Checklist Memory Analysis

Indikator	Volatility Plugin	Apa yang Dicari
Hidden process	psscan vs pslist	Proses ada di psscan tapi tidak di pslist = rootkit process hiding
No parent	pstree	PPID 0 atau PPID tidak ada = process didirectly injected
Suspicious offset	psscan	_EPROCESS offset tidak biasa antara pool tags
False binary path	cmdline, envars	C:\Windows\System32\rundll32.exe tapi DLL dari C:\Users\Public\
Injected code	malfind, vadinfo	RWX memory region yang bukan image mapping — inject detection
API hooking	apihooks	Inline hooks di ntdll.dll, kernel32.dll — userland rootkit
Suspicious handles	handles	Handle ke proses lain dengan PROCESS_ALL_ACCESS
Malfind output	malfind	Memory page dengan karakteristik VAD mismatch + execute permission
Driver signature	modscan, driverirp	Driver unsigned, IRP hooking
Registry hive	hivelist, hivedump	Abnormal registry keys, persistence

MalFind — Deteksi Process Injection

vol -f mem.dmp windows.malfind.Malfind --pid 1234
 
# Output example:
# Process: lsass.exe PID: 672
# Address 0x7f3d0000 tag: VAD
# File: ???
# Protect: PAGE_EXECUTE_READWRITE
# --- Hex dump (16 bytes) ---
# 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 ...
# --- Disassembly ---
# 0x7f3d0000    jmp     0x7f3d0010
# 0x7f3d0002    nop
#
# → MALICIOUS: PE header (MZ) mapped in lsass with RWX — classic process hollowing

Binary Instrumentation — Frida

Frida untuk dynamic instrumentation tanpa perlu reverse engineering penuh:

# hook.js
Interceptor.attach(Module.findExportByName("kernel32.dll", "CreateRemoteThread"), {
    onEnter: function(args) {
        console.log("[+] CreateRemoteThread called");
        console.log("    hProcess:", args[0]);
        console.log("    lpStartAddress:", args[2]);
        console.log("    lpParameter:", args[3]);
        this.startAddress = args[2];
    },
    onLeave: function(retval) {
        console.log("    Thread handle:", retval);
    }
});
 
# Run
frida "notepad.exe" -l hook.js --no-pause

Advanced Frida — Dekripsi Runtime

# intercept_decrypt.js
// Asumsikan malware punya fungsi decrypt di offset 0x401000
var decryptFunc = new NativePointer(ptr(Module.findBaseAddress("sample.exe")).add(0x1000));
Interceptor.attach(decryptFunc, {
    onEnter: function(args) {
        this.buffer = args[0];
        this.length = args[1].toInt32();
    },
    onLeave: function(retval) {
        // read decrypted data
        var decrypted = this.buffer.readByteArray(this.length);
        console.log("[+] Decrypted data:", hexdump(decrypted, { length: this.length }));
    }
});

YARA — Rule Authoring Advanced

YARA Module — PE-specific

import "pe"
 
rule APT_Malware_DLL {
    meta:
        description = "Detects APT malware DLL with specific PE characteristics"
    condition:
        pe.is_dll and
        pe.number_of_sections == 4 and
        pe.section_names[0] == ".text" and
        pe.section_names[1] == ".rdata" and
        pe.section_names[2] == ".data" and
        pe.section_names[3] == ".rsrc" and
        pe.entry_point >= 0x1000 and
        for any i in (0..pe.number_of_sections - 1):
            (
                pe.sections[i].raw_data_size >
                pe.sections[i].virtual_size and
                pe.sections[i].raw_data_size > 0
            )
}
 
rule C2_Domain_Regex {
    meta:
        description = "Mendeteksi C2 domain pattern dalam string"
    strings:
        // DGA-like domain patterns
        $dga1 = /http:\/\/[a-z]{8,12}\.(com|net|tk|cf|ga|ml)/
        // Base64-encoded C2
        $b64c2 = /[A-Za-z0-9+\/]{40,}={0,2}/
    condition:
        any of ($dga1) and #b64c2 > 3
}

YARA Module — Math (Entropy)

import "math"
 
rule High_Entropy_Section {
    meta:
        description = "Mendeteksi section dengan entropi tinggi — kemungkinan packed/encrypted"
    condition:
        for any i in (0..pe.number_of_sections - 1):
            (
                math.entropy(pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) > 7.0 and
                pe.sections[i].raw_data_size > 4096
            )
}

Packers vs Crypters — Detection

Type	Karakteristik	Detection
UPX	Compressed sections (UPX0, UPX1, UPX!), entry point OEP restore	YARA string “UPX!” + section names
Themida	Anti-debug, anti-VM, imported code obfuscation	Section .themida, high entropy, EP obfuscated
VMProtect	Code virtualization, anti-debug	Large .text section with virtualized bytecode
Crypters	Encrypt original PE → decrypt at runtime in memory	Emulation detection, anti-sandbox, delayed execution
ConfuserEx	.NET obfuscator — rename, constant encryption, control flow	Detect via metadata + string patterns
Obfuscator-LLVM	LLVM pass → control flow flattening, bogus control flow	No specific section pattern; anomaly in instruction distribution

Unpacking — generic approach:

1. Determine packer (Detect It Easy / DiE)
2. Set hardware breakpoint on OEP (use x64dbg or OllyDbg)
3. Dump process memory after OEP reached
4. Rebuild IAT (Import Address Table) — use Scylla plugin
5. Re-analyze with Ghidra/IDA

Sigma Rules untuk Malware Behavior Detection

Process Injection via CreateRemoteThread

title: CreateRemoteThread Detected
id: 4a1b2c3d-9e8f-7a6b-5c4d-3e2f1a0b9c8d
status: experimental
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 8 # CreateRemoteThread
    SourceImage|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\powershell.exe'
      - '\wmic.exe'
    TargetImage|endswith:
      - '\explorer.exe'
      - '\svchost.exe'
      - '\winlogon.exe'
      - '\lsass.exe'
    StartAddress|endswith:
      - '\ntdll.dll'
      - '\kernel32.dll'
  condition: selection
level: high

Malicious Service Installation

title: Suspicious Service Installed in User Temp
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11 # FileCreate
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
    TargetFilename|endswith: ".exe"
  filter:
    TargetFilename|contains:
      - '\Temp\Rar$'
      - '\Temp\7z'
  condition: selection and not filter
level: medium

Malware Analysis Virtual Lab Setup

Host (Linux/Kali)
├── VirtualBox / VMware
│   ├── REMnux v3 (malware analysis tools)
│   ├── Windows 10 VM (isolated — FLARE VM + tools)
│   │   ├── FLARE VM (FireEye's Windows analysis distro)
│   │   ├── ProcMon, Process Explorer, RegShot
│   │   ├── x64dbg, IDA Pro, Ghidra
│   │   ├── Wireshark, FakeNet, TCPView
│   │   └── Frida, Python 3
│   └── CAPE Sandbox (analysis engine)
├── Host-only network (isolated — no internet to real world)
│   └── InetSim (fake DNS, HTTP, SMTP)
└── Snapshot management (revert after each analysis)

---

Case Studies

Studi Kasus	Konteks	Temuan Kunci	Mitigasi Diimplementasi
NotPetya (2017)	Destructive wiper disguised sebagai ransomware — serangan supply chain via M.E.Doc	1. EternalBlue exploit + credential theft untuk lateral movement. 2. MBR overwrite + file encryption via SMB. 3. Static analysis: section name aneh, EP di section data. 4. Memory: lsass.exe credential dumping, volume shadow copy deletion.	1. MS17-010 patch. 2. SMB v1 disable. 3. Endpoint detection untuk lateral movement via PsExec/WMI. 4. Air-gapped backup.
Emotet Banking Trojan (2018-2021)	Modular loader → spread via spam, menjadi dropper untuk ransomware	1. PE: packed dengan custom crypter → high entropy. 2. Static: DGA domain pattern (8 char + .com/.net). 3. Dynamic: process hollowing ke svchost.exe. 4. Memory: injected code di svchost.exe → network beaconing.	1. YARA rule untuk DGA domain. 2. Behavior block: Office macro + OLE embedding. 3. URL reputation + DNS sinkhole. 4. EDR alert: process hollowing pattern.
Cobalt Strike Beacon (2024 variant)	Post-exploitation beacon — legitimate tool abused by ransomware gangs	1. Artifact: pipe names contain “MSSE-”, named pipe impersonation. 2. Network: HTTPS beaconing with JA3 fingerprint 51c64c77f60c… 3. Memory: reflective DLL loading — tidak ada file di disk. 4. Process: inject into explorer.exe via CreateRemoteThread + queue user APC.	1. JA3/JA3S fingerprint block. 2. Process creation monitoring — rundll32.exe → explorer.exe (abnormal). 3. Memory scanning untuk reflective loader pattern.
PlugX RAT (2023)	China-nexus RAT — USB propagation + encrypted C2	1. DLL side-loading via legitimate signed binary + malicious DLL. 2. RC4-encrypted C2 configuration embedded in .rsrc section. 3. USB autorun.inf + hidden directory for propagation. 4. Anti-analysis: checking for debugger via NtQueryInformationProcess.	1. Autorun disable via GPO. 2. DLL load monitoring (Sysmon Event 7) + signature validation. 3. Encrypted traffic analysis. 4. Application whitelisting (WDAC/AppLocker).
Simulated Malware IR (Tabletop, 2024)	Red team deploy custom backdoor — triage full cycle	1. Triage (L0): VirusTotal 7/70 detection → YARA match to “DCRat” family. 2. Static (L1): PEStudio — 2 suspicious sections, FLOSS decode base64 C2 URL. 3. Dynamic (L2): connects to C2 after 5-second sleep, downloads second-stage PowerShell payload. 4. Memory (L3): malfind mendeteksi hollowed svchost.exe. 5. Full RE (L4): Ghidra menemukan XOR key 0xAB untuk decrypt config.	1. C2 domain block via DNS sinkhole. 2. Host isolation. 3. Custom YARA for IOC. 4. Memory scan for all endpoints in same subnet.

---

Koneksi ke Vault

• firmware-reverse-engineering-deepdive — RE tingkat firmware/hardware yang melengkapi RE software malware
• endpoint-detection-playbook — triage forensik untuk host terkena malware (RAM dump, Volatility, persistence analysis)
• blueteam-detection-matrix — detection matrix yang mencakup malware behavioral detection
• comprehensive-threat-directory — taksonomi lengkap jenis malware dan threat actor
• ebpf-kernel-security — kernel-level detection (eBPF, Tetragon) untuk malware yang melakukan system call anomaly
• ebpf-beyond-security — eBPF untuk observability performa yang bisa mendeteksi crypto miner atau C2 beacon
• incident-response-framework — konteks IR yang lebih luas (containment, eradication, recovery)
• cobalt-strike dan sliver — C2 framework yang post-exploitation artifact bisa dianalisis dengan teknik di sini
• browser-security-exploitation-deepdive — browser-based malware dan drive-by download analysis
• web-hacking-exploitation — web-based malware injection dan webshell analysis

---

Referensi

1. Mandiant (FLARE). FLARE VM. https://github.com/mandiant/flare-vm
2. Mandiant. FLOSS — Obfuscated String Solver. https://github.com/mandiant/floss
3. Mandiant. CAPA — Malware Capability Detection. https://github.com/mandiant/capa
4. VirusTotal. VirusTotal API Documentation. https://developers.virustotal.com/reference/overview
5. YARA. YARA Documentation. https://yara.readthedocs.io/en/stable/
6. Volatility Foundation. Volatility 3. https://volatility3.dev/
7. Frida. Frida Dynamic Instrumentation. https://frida.re/docs/home/
8. Ghidra (NSA). Ghidra RE Framework. https://ghidra-sre.org/
9. IDA Pro (Hex-Rays). IDA Disassembler. https://hex-rays.com/ida-pro/
10. CAPE Sandbox. CAPE — Malware Sandbox. https://github.com/kevoreilly/CAPE/
11. ANY.RUN. Malware Analysis Platform. https://any.run/
12. Cuckoo Foundation. Cuckoo Sandbox. https://cuckoosandbox.org/ (archived)
13. InetSim. InetSim Documentation. https://www.inetsim.org/
14. Monnappa, K A. Learning Malware Analysis. Packt Publishing, 2018.
15. Sikorski, Michael & Andrew Honig. Practical Malware Analysis. No Starch Press, 2012.
16. Ligh, Michael Hale et al. The Art of Memory Forensics. Wiley, 2014.
17. Eagle, Chris. The IDA Pro Book, 2nd Ed. No Starch Press, 2011.
18. MITRE ATT&CK. Malware Techniques. https://attack.mitre.org/techniques/enterprise/
19. Sigma HQ. Sigma Malware Detection Rules. https://github.com/SigmaHQ/sigma/tree/master/rules/malware/
20. OWASP. Malware Analysis Guide. https://owasp.org/www-community/Malware_Analysis
21. SANS. FOR610: Reverse Engineering Malware. https://www.sans.org/cyber-security-courses/reverse-engineering-malware/
22. Any.Run. Interactive Malware Analysis. https://app.any.run/
23. Hybrid Analysis. Malware Analysis Platform. https://www.hybrid-analysis.com/
24. Joe Security. Joe Sandbox. https://www.joesecurity.org/
25. VirusShare. Malware Samples Collection. https://virusshare.com/

Bottom Line

Malware analysis adalah skill yang dibangun bertahap — mulai dari triage cepat (VirusTotal + YARA + CAPA), lanjut ke static analysis (PEStudio + FLOSS + strings), lalu dynamic di sandbox terisolasi, dan akhirnya memory forensics dengan Volatility. 80% incident response hanya butuh L0–L2; sisanya (L3-L4) untuk APT dan zero-day. Kuncinya: otomatisasi triage dengan YARA + CAPA, sandbox terisolasi untuk dynamic analysis, Volatility untuk post-infection memory artifacts. Investasi paling besar bukan di tool — tapi di lab yang reproducible (REMnux + FLARE VM + snapshots) dan playbook yang terdokumentasi sehingga setiap analyst (junior sekalipun) bisa melakukan triage konsisten dalam <30 menit.