I85PREP
⌘ K
CCOA study materials
CCOA study resources

CCOA (ISACA): Malware Behavior and Artifact Analysis

CCOA · Work through your exam, one topic at a time.

All guide sections

Malware Behavior and Artifact Analysis

This domain tests structured static and dynamic analysis: forming hypotheses from file structure, confirming them with behavior, and turning both into detection content.

Static analysis first

  • Identify the true file type by magic bytes, never by extension. Compute SHA-256 before touching anything.
  • PE inspection: compile timestamp, section names and sizes, section entropy (above roughly 7.0 suggests packing or encryption), import table, resources, digital signature.
  • Sparse import tables with only LoadLibrary/GetProcAddress imply runtime resolution; VirtualAlloc, WriteProcessMemory, and CreateRemoteThread imply injection.
  • Documents and containers: OLE/VBA macros, remote template injection, LNK argument abuse, ISO/IMG files used to bypass Mark-of-the-Web.

Dynamic and behavioral analysis

  • Sandbox plus local instrumentation (Procmon, Regshot, packet capture) to observe file, registry, and network effects.
  • Persistence: Run keys, scheduled tasks, services, WMI event subscriptions, startup folders.
  • Defense evasion: AMSI bypass strings, ETW patching, LOLBins such as certutil, mshta, rundll32.
  • Command and control: jittered beacon intervals, DNS or HTTPS with self-signed certificates, fallback channels.

Worked example

A sample has overall entropy 7.9, an almost empty import table, and sections named .UPX0 and .UPX1. Reasoning: the UPX section names and high entropy indicate a packed binary; the import table is small because the packer resolves APIs at runtime. Correct next step is to unpack (statically or by dumping from memory in a sandbox), then re-examine imports. After unpacking, CryptEncrypt plus CreateRemoteThread would support a hypothesis of an injector with ransomware capability. Confirm behaviorally by looking for Sysmon 8 and 10 events on a test host, not on production.

Traps that cost marks

  • Running a sample on a production or analyst workstation instead of an isolated VM.
  • Hash-only detection: repacking or recompiling changes the hash while behavior stays identical.
  • Missing DLL side-loading, where a signed legitimate executable loads a malicious DLL from its own directory.
  • Confusing a packer with an encryptor - packing compresses/obfuscates, it does not necessarily protect data.