Now that we found our Malware, what we want to do
is decompile it.
From this point forward, everything
I'm going to teach you is done with open-source tools.
The commercial tools can only get you so far.
So in that last lab, if you scanned for Malware,
you would see that the Malware scanner did not
detect anything.
The reason it didn't is that signature on that
piece of Malware is older, and it
doesn't exist in the Bit Defender database anymore.
So you had to hunt that on your own.
Now we found it.
I want to give you options on what you can do at this point.
We are going to focus on static analysis.
Static analysis is essentially non-runtime.
It's data at rest.
So exactly how we uncovered that piece of Malware,
we're not going to watch it in action.
If we want to watch something in action,
that would be dynamic analysis or in a live state.
If you want to know what Malware looks like dynamically,
there's a bonus lab on ISO B. And you can actually
see that we captured some of the traffic with Wireshark.
So you can go and examine what that
looked like when that application was being used.