Scribd Logo
Upload

Welcome to Scribd!

  • 3K views

    Malware Report Template

    Uploaded by

    La Tonya IbekilliNem Williams
    Template for preparing a Malware Analysis report with inclusion suggestions and/or questions to assist with what information to include.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd

    Malware Report Template

    Uploaded by

    La Tonya IbekilliNem Williams
    3K views3 pages
    Template for preparing a Malware Analysis report with inclusion suggestions and/or questions to assist with what information to include.

    Copyright

    © © All Rights Reserved

    Available Formats

    DOC, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Template for preparing a Malware Analysis report with inclusion suggestions and/or questions to assist with what information to include.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd
    Download as doc, pdf, or txt
    3K views3 pages

    Malware Report Template

    Uploaded by

    La Tonya IbekilliNem Williams
    Template for preparing a Malware Analysis report with inclusion suggestions and/or questions to assist with what information to include.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd
    Download as doc, pdf, or txt
    You are on page 1of 3

    Malware Report Template with Examples

    The following report template can be used to document the results of a malware
    analysis done using the Malware Toolkit. This template has two pages: the first is the
    template with examples to show how it might be filled out, while the second is a
    blank template. Customize this as necessary to fit your own needs.
    Title: [something distinctive: e.g. "malware investigation of 12/15/10: Joe Smith
    workstation"]
    Investigator(s):
    Report Date: [12/15/2010]
    Background
    [describe trigger event, initial notification, symptoms, etc.]
    Investigation Goals
    [determine extent of infection, determine risk of data exposure, figure out how
    infected, etc.]
    Key Questions and Answers:
    How did the malware infection occur?
    [drive-by infection from site Y]
    When did the malware infection occur?
    [Sept. 1, 2010 11:15AM]
    What vulnerabilities allowed the infection to occur?
    [Unpatched Adobe Flash]
    What is the risk of data loss?
    [High: Zeus on machine for 3 months]
    Conclusions
    [On Sept. 1, 2010, While browsing site Y in the normal course of business, Joe
    triggered a drive-by infection probably coming from a banner ad. The drive-by
    infection triggered a series of exploit steps, eventually resulting in installation of a
    trojan downloader and the Zeus trojan. Because Zeus is a data-stealing trojan, any
    sensitive information handled by Joe between Sept. 1st and the date of the
    investigation (December 1, 2010) should be considered potentially compromised.]
    Evidence and Key data elements
    [timeline entries showing evidence supporting conclusions, anti-virus or virustotal
    reports of malware types, etc.]

    Followup Actions and Lessons Learned


    [list actions that can/should be taken as a result of investigation plus
    recommendations]
    1. [Joe should change passwords to all systems logged into during exposure
    window]
    2. [recommend PII analysis of customer data during 3-month exposure windows
    to identify at-risk clients]
    3. [accelerate application of Adobe Flash updates]

    4. [Banner Ads should be blocked at web filter]


    Title:
    Investigator(s):
    Report Date:
    Background
    Investigation Goals
    Key Questions and Answers:
    How did the malware infection occur?

    When did the malware infection occur?

    What vulnerabilities allowed the infection to occur?

    What is the risk of data loss?

    Conclusions

    Evidence and Key data elements

    Followup Actions and Lessons Learned


    1.
    2.
    3.
    4.

    Summary of the analysis: Key takeaways should the reader get from the report
    regarding the specimens nature, origin, capabilities, and other relevant
    characteristics
    Identification: The type of the file, its name, size, hashes (such as MD5, SHA1,
    and ssdeep), malware names (if known), current anti-virus detection capabilities
    Characteristics: The specimens capabilities for infecting files, self-preservation,
    spreading, leaking data, interacting with the attacker, and so on
    Dependencies: Files and network resources related to the specimens
    functionality, such as supported OS versions and required initialization files,
    custom DLLs, executables, URLs, and scripts
    Behavioral and code analysis findings: Overview of the analysts behavioral, as
    well as static and dynamic code analysis observations
    Supporting figures: Logs, screenshots, string excerpts, function listings, and other
    exhibits that support the investigators analysis
    Incident recommendations: Indicators for detecting the specimen on other systems
    and networks (a.k.a. indicators of compromise), and possible for eradication
    steps

    Things that can go here include:

    Persistence mechansisms (how the specimen survives things like reboots)


    Installation procedures (how the specimen is installed / gets on the system)
    Registry interactions
    File system interactions
    Network interactions
    etc.

    You might also like