Static Malware Analysis to Identify Ransomware Properties

The study in this paper presents the results of ransomware analysis to identify the characteristic properties that distinguish ransomware executable from other malware and benign executables. The executables are analyzed both statically and dynamically to observe the typical structure and behavior of the ransomware. Static analysis is used to extract ransomware specific properties from the executable file. The inclusion of these properties with the set of generic malware properties has shown improved classification for malware detection specifically ransomware using well-proven software verification and validation techniques. Runtime analysis identifies the most common behavior of the ransomware. The paper is focused upon the ransomware attacks which have risen exponentially over the past decade with increasing severity. This has the conventional anti-malware techniques compelled to include advanced detection mechanisms for ransomware and this paper demonstrates a method to identify the properties related to such software environments