## 2 Background and Literature Review
### Methods for Static Malware Analysis  
The process of examining a potential malware without executing it is referred to as static analysis. One of the initial steps in the process of static analysis is to determine whether the malware in question has been previously identified and documented by the public. In order to identify whether a particular program is already known to the public, one can attempt to search for its signature in a database of known malware, such as MalwareBazar [14] or VirusTotal [15]. A signature can be defined as any value obtained through a specific procedure that is capable of uniquely identifying a program. The most prevalent methodology for extracting a program's signature is to calculate its hash value. In so doing, each and every bit of the program's code is employed in order to calculate the hash in conjunction with the corresponding hash function. The most commonly utilized hashes are MD5, SHA256 and SHA512. Additionally, numerous tools are available for directly identifying a program's hash value. One such tool is HashMyFiles, developed by NirSoft [16]. While this approach initially appears promising, further analysis in Section 2.3 reveals its inherent limitations. Modern malware is designed to evade identification by modifying its own code and consequently altering the associated hash, effectively rendering it unknown to the digital ecosystem. A further development of the signature approach is the use of YARA rules. The special syntax of YARA allows the definition of specific identification rules, as illustrated in Figure 6. Any file containing the string \(a\), \(b\) or \(c\) is flagged as _silent_banker_. Further details can be found in the YARA documentation [17]. There exist other static analysis tools, such as OLEVBA, YARA rules and other specialised utilities, each of which serves a distinct purpose within the malware analysis ecosystem. OLEVBA, which is part of the oletools suite developed by [PERSON], assists with the manual static analysis process by extracting and analysing VBA macros from Office documents. It is particularly effective at processing the ovbaProject.bin file and other OLE2 compound document structures. It excels at identifying suspicious VBA code patterns, extracting embedded URLs, detecting code obfuscation techniques and flagging malicious behaviours, such as auto-execution macros or shell command invocations. However, OLEVBA primarily functions as an information extraction utility rather than a definitive classification system--it presents analysts with raw findings and indicators, but human expertise is required to interpret the significance of these discoveries and make final determinations of malicious intent. Additionally, its knowledge scope is limited to predefined patterns and heuristics, lacking the broader contextual understanding necessary to adapt to novel attack vectors or sophisticated evasion techniques. Similarly, YARA rules are a powerful and widely adopted approach to malware detection. They offer exceptional efficiency in identifying known malware variants through pattern-matching algorithms. YARA's strength lies in its ability to define precise byte patterns, string sequences and structural characteristics that can reliably identify specific malware families or exploitation techniques. Security researchers and organisations worldwide contribute to extensive YARA rule repositories, creating a collaborative defense mechanism against established threats. However, this signature-based approach has the fundamental limitation of requiring prior knowledge of malicious patterns--YARA rules must be manually crafted by analysts who have reverse-engineered and understood specific threats. Consequently, these systems remain vulnerable to zero-day exploits, polymorphic malware and novel attack methodologies that do not match existing rule sets. Furthermore, maintaining comprehensive and up-to-date YARA rule  
Figure 6: Exemplary YARA rule [17].