What to Include in a Malware Analysis Report

In my SANS Institute course, I teach security and systems professionals how to reverse-engineer malicious software. The following note summarizes my recommendations for what to include in the report that describes the results of the malware analysis process.

A typical malware analysis report covers the following areas:

Summary of the analysis: Key takeaways should the reader get from the report regarding the specimen's nature, origin, capabilities, and other relevant characteristics
Identification: The type of the file, its name, size, hashes (such as MD5, SHA1, and ssdeep), malware names (if known), current anti-virus detection capabilities
Characteristics: The specimen's capabilities for infecting files, self-preservation, spreading, leaking data, interacting with the attacker, and so on
Dependencies: Files and network resources related to the specimen’s functionality, such as supported OS versions and required initialization files, custom DLLs, executables, URLs, and scripts
Behavioral and code analysis findings: Overview of the analyst's behavioral, as well as static and dynamic code analysis observations
Supporting figures: Logs, screenshots, string excerpts, function listings, and other exhibits that support the investigators analysis
Incident recommendations: Indicators for detecting the specimen on other systems and networks (a.k.a. "indicators of compromise"), and possible for eradication steps

Malware analysis should be performed according to a repeatable process. To accomplish this, the analyst should save logs, take screen shots, and maintain notes during the examination. This data will allow the person to create an analysis report with sufficient detail that will allow a similarly-skilled analyst to arrive at equivalent results.

A convenient way of keeping track of your observations during the reverse-engineering process is to use a mind map, which organizes your notes, links, and screenshots on a single easy-to-see canvas. You can download my mind map template for such a report; you need to use the free mind-mapping tool called FreeMind to load and edit the template.

About the Author: Lenny Zeltser is a seasoned IT professional with a strong background in information security and business management. His areas of expertise include cloud services and malicious software. Lenny focuses on safeguarding customers' IT operations at Radiant Systems. He also teaches how to analyze and combat malware at SANS Institute. Lenny explores security topics at conferences, in books and in articles. He also volunteers as an incident handler at the Internet Storm Center. You should follow Lenny on Twitter and read his daily blog.