# Malware Analysis

> 恶意软件分析 — 沙箱、动态分析、脱壳、反混淆、YARA规则

- Skill: `aivos-xie/malware-analysis` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aivos-xie/malware-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aivos-xie/malware-analysis/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: aivos-xie (https://skillmd.com/u/aivos-xie)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aivos-xie/malware-analysis

---


# 恶意软件分析工具链

## 核心工具

| 工具 | 用途 |
|------|------|
| **YARA** | 模式匹配/恶意软件分类 |
| **PEframe** | PE文件静态分析 |
| **PEiD** | 壳/编译器检测 |
| **Detect It Easy (DIE)** | 壳/编译器检测(PEiD替代) |
| **UPX** | 脱壳/加壳 |
| **Fakenet-NG** | 网络模拟 |
| **Procmon** | 进程监控(Windows) |
| **x64dbg/OllyDbg** | Windows调试器 |
| **Cuckoo Sandbox** | 自动化沙箱 |
| **CAPE** | Cuckoo改进版沙箱 |
| **Any.Run** | 在线沙箱 |
| **VirusTotal** | 在线扫描 |
| **MalwareBazaar** | 恶意样本库 |
| **strings** | 字符串提取 |
| **ssdeep** | 模糊哈希 |
| **Volatility** | 内存取证 |
| **ClamAV** | 开源杀毒引擎 |
| **Radare2/Ghidra** | 反编译 |

---

## 1. YARA — 模式匹配

### 安装
```bash
sudo apt install yara
pip install yara-python
```

### 基本用法
```bash
# 扫描文件/目录
yara rules.yar target_file
yara -r rules.yar /path/to/scan/

# 常用选项
yara -s rules.yar target_file    # 显示匹配的字符串
yara -m rules.yar target_file    # 显示元数据
yara -w rules.yar target_file    # 抑制警告
```

### YARA规则编写
```yara
rule malware_detection {
    meta:
        description = "Detects ExampleMalware"
        author = "Hermes"
        date = "2024-01-01"
        hash = "abc123..."

    strings:
        $s1 = "cmd.exe /c" ascii
        $s2 = "HKEY_LOCAL_MACHINE" ascii
        $s3 = { 6A 40 68 00 30 00 00 6A 14 }  // hex pattern
        $s4 = /https?:\/\/[a-z0-9\.]+\/[a-z]+/  // regex
        $mutex = "Global\\MyMalwareMutex" wide

    condition:
        uint16(0) == 0x5A4D and  // PE文件
        filesize < 500KB and
        2 of ($s*) and
        $mutex
}
```

### YARA进阶
```yara
// PE导入表检测
rule pe_imports {
    condition:
        pe.imports("kernel32.dll", "VirtualAlloc") and
        pe.imports("ws2_32.dll", "connect")
}

// 加壳检测
rule packed_pe {
    condition:
        pe.sections[0].name == "UPX0" or
        pe.number_of_sections < 3
}

// 字符串加密检测
rule encrypted_strings {
    strings:
        $xor = { 31 C0 40 31 DB }  // XOR解密循环
    condition:
        $xor and filesize < 100KB
}
```

### 在线YARA仓库
```bash
git clone https://github.com/Yara-Rules/rules.git
# 规则分类: malware/, exploit_kits/, crypto/, packers/
```

---

## 2. PE文件分析

### PEframe
```bash
pip install peframe

peframe malware.exe
# 输出: 壳信息、导入表、节信息、字符串、URL、IP
```

### pefile (Python)
```python
import pefile

pe = pefile.PE("malware.exe")

# 基本信息
print(f"Entry: 0x{pe.OPTIONAL_HEADER.AddressOfEntryPoint:x}")
print(f"ImageBase: 0x{pe.OPTIONAL_HEADER.ImageBase:x}")
print(f"Sections: {len(pe.sections)}")

# 节信息
for section in pe.sections:
    print(f"{section.Name}: VA=0x{section.VirtualAddress:x} Size={section.Misc_VirtualSize}")

# 导入表
if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
    for entry in pe.DIRECTORY_ENTRY_IMPORT:
        print(f"\n{entry.dll.decode()}")
        for imp in entry.imports:
            print(f"  {imp.name.decode() if imp.name else 'ordinal'}")

# 字符串
data = open("malware.exe", "rb").read()
import re
strings = re.findall(b'[\x20-\x7e]{6,}', data)
for s in strings[:20]:
    print(s.decode())
```

### Detect It Easy (DIE)
```bash
# 下载
wget https://github.com/horsicq/DIE-engine/releases/latest/download/die_linux64_portable.tar.gz
tar xzf die_linux64_portable.tar.gz

# 命令行
die malware.exe
diec malware.exe
```

---

## 3. 脱壳

### UPX脱壳
```bash
# 检测
upx -t malware.exe

# 脱壳
upx -d malware.exe -o unpacked.exe

# 如果UPX被修改/损坏
# 1. 找到OEP(Original Entry Point)
# 2. 运行到OEP后dump内存
```

### 手动脱壳流程
```
1. 用x64dbg加载
2. F8单步到JMP/跳转指令
3. 找到跳向OEP的跳转(通常是一个大的JMP)
4. 在OEP处设置断点
5. 运行到断点
6. 使用Scylla/MiniDump dump进程
7. 修复导入表(IAT)
```

### 自动脱壳工具
```bash
# ClamUnpacker
# UnpacMe (在线)
# https://unpac.me/

# VMUnpacker
# 虚拟机检测 + 自动脱壳
```

---

## 4. 动态分析

### 基本流程
```
1. 隔离环境(VM/沙箱)
2. 快照当前状态
3. 启动监控工具
4. 运行恶意软件
5. 收集行为数据
6. 恢复快照
```

### 网络监控
```bash
# Fakenet-NG (模拟网络)
# 恶意软件会尝试连接C2服务器
# Fakenet模拟所有协议，捕获通信

# Wireshark/tshark
tshark -i eth0 -w capture.pcap
tshark -r capture.pcap -Y "http.request"

# INetSim (模拟服务)
sudo apt install inetsim
inetsim --conf /etc/inetsim/inetsim.conf
```

### 文件系统监控
```bash
# Linux
strace -e trace=file -f malware

# 用inotifywait
inotifywait -mr /tmp/monitor/

# 创建监控目录
mkdir -p /tmp/monitor && cd /tmp/monitor
# 运行恶意软件，检查新增文件
find . -newer marker_file -type f
```

### 进程监控
```bash
# Linux
ps aux | grep malware
ls -la /proc/PID/exe
cat /proc/PID/maps

# 查看网络连接
ss -tlnp
netstat -tlnp
lsof -i

# 查看子进程
pstree -p PID
```

---

## 5. Cuckoo/CAPE沙箱

### Cuckoo安装(简化)
```bash
# 需要VirtualBox + 虚拟机
sudo apt install virtualbox
pip install cuckoo

# 初始化
cuckoo init

# 配置虚拟机
cuckoo machine

# 提交样本
cuckoo submit malware.exe

# 查看报告
cuckoo report 1
```

### 在线沙箱
```
https://www.virustotal.com     # 多引擎扫描
https://any.run                # 交互式沙箱
https://www.hybrid-analysis.com
https://unpac.me               # 脱壳专用
https://bazaar.abuse.ch        # 恶意样本库
```

---

## 6. 混淆/反调试绕过

### 常见反调试技术
```
1. IsDebuggerPresent()
2. NtQueryInformationProcess()
3. CheckRemoteDebuggerPresent()
4. 时间检查(RDTSC)
5. INT 2D
6. PEB.BeingDebugged
7. TLS回调
8. 异常处理
9. 父进程检查
10. 沙箱检测(鼠标移动、进程数、MAC地址)
```

### 绕过方法
```python
# Patch IsDebuggerPresent
# 将mov eax, [fs:0x30] + 检查BeingDebugged的代码patch为NOP

# 修改PEB
# 在调试器中:
# !peb → 找到BeingDebugged → 修改为0

# 绕过时间检查
# 在调试器中hook RDTSC指令

# 绕过沙箱检测
# 修改MAC地址、主机名、用户名
# 模拟鼠标移动
# 延迟执行(等沙箱超时)
```

### 脱壳+去混淆流程
```
1. DIE检测壳类型
2. UPX直接脱壳
3. 其他壳: x64dbg手动脱壳
4. Ghidra分析去混淆后的代码
5. 提取C2地址、通信协议
6. 编写解密脚本
```

---

## 7. 特征提取

### 从恶意软件提取IOC
```bash
# 文件哈希
md5sum malware.exe
sha256sum malware.exe
ssdeep malware.exe      # 模糊哈希

# 字符串
strings -n 8 malware.exe
strings -el malware.exe  # 宽字符

# 网络指标
strings malware.exe | grep -E 'https?://|[\d\.]+:\d+'
strings malware.exe | grep -E '\.onion|\.xyz|\.top'

# 注册表
strings malware.exe | grep -i 'HKEY_\|CurrentVersion\\\\Run'

# 文件路径
strings malware.exe | grep -i 'AppData\\\\|Temp\\\\|System32'
```

### ssdeep模糊哈希
```bash
pip install ssdeep
ssdeep -b malware1.exe > hash1.txt
ssdeep -b malware2.exe > hash2.txt
ssdeep -br hash1.txt hash2.txt

# Python
import ssdeep
h1 = ssdeep.hash_from_file("malware1.exe")
h2 = ssdeep.hash_from_file("malware2.exe")
print(ssdeep.compare(h1, h2))  # 0-100相似度
```

---

## Pitfalls

1. **永远在隔离环境分析** — 用VM或物理隔离机器
2. **断网分析** — 除非需要抓C2通信
3. **先拍照再运行** — VM快照是恢复的保障
4. **YARA规则要更新** — 恶意软件变种快
5. **手动脱壳需要练习** — 没有万能方法
6. **沙箱检测是常见的** — 恶意软件会检测沙箱并改变行为
7. **字符串可能加密** — 需要先解密再分析
8. **加壳不等于恶意** — 很多合法软件也加壳