## 2 Background  
Today, malicious code, hereinafter referred to as malware, has evolved into one of the most important dangers and threats that affects the security of information technology (IT) systems. The degree of the technique complexity and the level of knowledge needed to analyze malware is proportional to the level of sophistication of the sample. The main benefits of malware analysis are the following [2; 9]:  
* To assess the malware detection capability of organizations' protection systems
* To evaluate the damage caused by the intrusion and malware actions
* To discover other machines that have been affected by the same malware
* To identify the vulnerability that was exploited by the malware, to obtain the software update that mitigates it, if available
* To obtain enough data and information to implement the appropriate defense mechanisms to mitigate and neutralize the damage caused by the malware, including firewall rules, host and network intrusion detection systems, firewall, and antivirus
* To determine the level of malware sophistication and complexity
* If it is possible, to determine the origin of an attack and to identify the intruder and malware developer In the analysis of malware, a series of methods and techniques are required for any analysis. They will help analysts to understand the risks, threats, and intentions associated with the malware. Thus, the obtained information may be used to reconfigure the organization's defenses in order to detect it and being protected against it. The first and oldest analysis method used in analysis of malware is observation. [PERSON], in his doctoral thesis [10], use this method to compare the states of a system before and after verified malware activity. Data is achieved by the mere observation of a machine for clues modifications of registers, files or creation of new ones as, for example, 'enbiei.exe' activity which indicates 'Blaster Worm' malware. [PERSON], in the article \"Reverting Malware, Confirms the Following: A Detection Intelligence with In-Depth Security Analysis\" [11], provides a review of the most relevant malware analysis techniques. Specifically, three specific and differentiated lines of work are identified, such as the following:  
* Static Code Analysis: technique that collects as much information as possible of a binary without actually executing it. To do it, disassembly and reverse engineering techniques are used. This latter technique of analysis includes others more specific as string analysis, reverse engineering, packaging, obfuscation, restricted execution environments, etc. A tool to perform this type of analysis is IDA PRO [12] or GHIDRA [13]. * Dynamic code analysis: the analysis is basically done through a type of tools called 'debuggers' that are associated with the program code under analysis to take full control of them, allowing the possibility executing it code line by code line. Some popular debuggers for malware analysis are OlyDbg [14], ImmunityDbg [15], and WinDbg [16]. * Dynamic or behavioral analysis: It analyzes the binary or specimen malware while it is running focusing on the supervision and monitorization of the malware interaction with the environment. The aim is to look for changes in the infected machine where it is running, network traffic and potential external communications with command and control servers. It can be done manually in a virtual or physical environment using different tools that collect the data of its interaction with the machine infected or automatically by \"Sandbox\" toolset [17]. The Figure 1 summarizes the main methods and techniques for the analysis of malware that we have identified as a framework. As it has been mentioned in the previous paragraphs, all of them present a series of advantages and disadvantages that mean that malware analysis cannot be carried out using a single method or technique. Once the different types and methods of malware analysis have been shown, the following paragraphs present various considerations reflected in different scientific research articles.