Malware Analyst

Job description

• Document malware threats and identify procedures to avoid them
• Static and dynamic analyses using tools to identify threats
• Classify malware based on threats and commonalities
• Write alerts to let security personnel know about the latest threats
• Understand tools that identify zero day cyber threats and work to protect from them
• Participate in research and development of malware protection tools
• Ability to setup collection mechanisms for malware samples (honey pots)
• Ability to setup virtualized environments for malware analysis

Capabilities for Malware Analysis

Fundamentals

• Networking and TCP/IP
• Operating system internals (Windows and Unix)
• Computer security
• Forensics and incident response
• Programming (Assembly, C, C++, Python, and Perl)
• Assemble a toolkit for effective malware analysis
• Examine static properties of suspicious programs
• Perform behavioural analysis of malicious executables
• Perform static and dynamic code analysis of malicious executables
• Contribute insights to the organization's larger incident response effort

Malicious Code Analysis

• Core concepts for analysing malware at the code level
• x86 Intel assembly language primer for malware analysts
• Identifying key x86 assembly logic structures with a disassembler
• Patterns of common malware characteristics at the Windows API level (DLL injection, function hooking, key-logging, communicating over HTTP, etc.)

In-Depth Malware Analysis

• Recognizing packed malware
• Automated malware unpacking tools and approaches
• Manual unpacking of malware using OllyDbg, process dumping tools and imports-rebuilding utilities
• Intercept network connections in the malware lab
• Interact with malicious websites to examine their nature
• De-obfuscate browser scripts using debuggers and runtime interpreters
• JavaScript analysis complications

Self-Defending Malware

• Bypassing anti-analysis defences
• Recovering concealed malicious code and data
• Unpacking more sophisticated packers to locate the Original Entry Point
• Identifying and disabling methods employed by malware to detect analysts' tools
• Analyzing shellcode to assist with the examination of malicious documents and other artefacts

Malicious Documents and Memory Forensics

• Analyze malicious Microsoft Office (Word, Excel, PowerPoint) documents
• Analyze malicious Adobe PDF documents
• Analyze memory to assess malware characteristics and reconstruct infection artefacts
• Using memory forensics to analyze rootkit infections

Essential Qualifications

• 6-8 years experience as a SOC specialist/Malware analyst
• Certifications in Networking, OS, Infosec and languages (C, C++, Perl, Python Assembly)
• Bachelors degree in Computer Science