What specific indicators of compromise are typically identified during static malware analysis, and how are they used?

During static malware analysis, several specific indicators of compromise (IOCs) are typically identified. These include: Hashes of the malware file, which are unique fingerprints used to identify and track the malware across different systems and networks. Imported functions, which reveal the Windows API functions the malware uses, providing clues about its capabilities, such as file manipulation, network communication, or system modification. Embedded strings, which can include URLs, IP addresses, filenames, registry keys, or other text strings that the malware uses. These strings can reveal command-and-control servers, configuration settings, or targeted files. File headers, which indicate the file type (e.g., PE, ELF) and can reveal information about the compiler used to create the malware. Metadata, such as compilation timestamps and digital signatures, which can provide insights into the malware's origin and authenticity. These IOCs are used in several ways. Hashes are used to identify known malware samples and to prevent their execution on systems. Imported functions are used to understand the malware's behavior and to develop detection signatures. Embedded strings are used to identify command-and-control infrastructure, target specific systems, or locate related malware samples. File headers help classify the malware and determine its capabilities. Metadata is used to assess the malware's trustworthiness and to track its distribution. By identifying these IOCs, analysts can develop detection rules for intrusion detection systems and antivirus software, create threat intelligence reports, and understand the attacker's tactics, techniques, and procedures (TTPs).