McAfee QUICKCLEAN 3.0 User's Guide download pdf (Page 109)

• On the right-hand side, a table provides the properties of the file. This includes information such

as:

• Signed or unsigned for the digital signature of the file.

• Publisher's name if available.

• Version details

• Original name of the file so that you can search other sources such as the web.

• Baitexe process infected or not. At the end of each analysis McAfee Advanced Threat Defense

creates an additional bait process called Baitexe. This Baitexe program calls two APIs (beep and

sleep) only continuously. If this Baitexe process is infected by the previously executed sample, the

behavior of Baitexe is different. In this case, a message Baitexe activated and infected is displayed.

If the Baitexe process is not infected at all, the message Baitexe activated but not infected is

displayed.

Classification / threat score section

This is a section in the Analysis Summary report, which provides the severity scores for various

characteristics of a typical malware.

Table 7-8 Classification / threat score section

Label Description

Persistence, Installation Boot

Survival

Some malware have the capability to remain on the infected host. This is

referred to as persistence. Installation boot survival refers to the capability

of the malware to sustain even after a restart.

Hiding, Camouflage,

Stealthness, Detection and

Removal Protection

This refers to the capability of the malware to evade detection and removal.

Security Solution /

Mechanism bypass,

termination and removal, Anti

Debugging, VM Detection

This refers to the capability of the malware to bypass or mislead detecting

methods and engines. Some malware has anti-disassembly code, which can

confuse or delay malware analysis. Some malware attempt to determine if

they are being executed in a sandbox. If true, they might take a different

execution path. This score indicates the presence of such code in the

malware.

Spreading

Indicates the capability of the malware to spread across the network.

Exploiting, Shellcode

Indicates the presence of shellcode that can exploit a running program.

Networking

Indicates the network-related behavior of the malware during dynamic

analysis. For example, the malware might have triggered DNS queries or

created sockets. If there is a severity score provided for this characteristic,

correlate with the Network Operations details for the files in the sample.

Data spying, Sniffing,

Keylogging, Ebanking Fraud

Indicates if the malware is capable of any such behaviors.

Operations details section

This section provides the details of every operation performed by a file during dynamic analysis.

Separate sections are provided for every file that was executed as part of the sample.

• Run-time DLLs: Lists all the DLLs and their paths that were called by a file in runtime.

• File operations: Lists file operation activities like creation, open, query, modification, copy, move,

deletion, and directory creation/deletion operations. This section also lists the file attributes and

the MD5 hash value for the files.

• Registry operations: Provides the details of Windows registry operation activities like creation/open,

deletion, modification, and query on registry sub-key and key entry.

Analyzing malware

View the analysis results

McAfee Advanced Threat Defense 3.0.4 Product Guide

109

1 2 ... 104 105 106 107 108 109 110 111 112 113 114 ... 139 140

Comments to this Manuals

No comments

McAfee QUICKCLEAN 3.0 User's Guide Page 109

Comments to this Manuals

Related products and manuals for Networking McAfee QUICKCLEAN 3.0