# Investigating IPTV Malware in the Wild
## 6 Conclusions
### Limitations and Future Work  
While the experiment results imply that the IITMAF is effective at collecting and analysing malware from illegal IPTV technologies, it does have limitations. One limitation of the IITMAF software is that the time to complete the analysis is high, as multiple URLs and files are submitted to dynamic analysis, which can take time. In addition to this, the iterative approach employed in the methodology extends the analysis time even further. However, dynamic analysis and URL collection limits can be set to shorten this duration, providing configurability for the IITMAF. The depth of the recursion can be set using the internal parameters of the IITMAF. For this reason, per comparison, we have focused on the correct identification of the URL and IPTV resource. Another limitation of the framework is that it provides limited analysis results for archive and Android-specific files, as they cannot be executed in the default Windows sandbox. Despite any limitations, the IITMAF focuses chiefly on the analysis of illicit IPTV websites, but we plan to address these limitations in the future work section. Additionally, our solution presents a guideline for the digital investigation of malicious files for the illegal IPTV domain rather than constituting a real-time application for stopping users from installing these applications, as the installation and access in most cases are conducted by the user themself without understanding/knowing the malicious intent behind. For the real-time application of the IITMAF, the signatures that are generated with the in-depth URL analysis would include the signatures that are branching from the suspicious/malicious URL itself. These in turn can be fed into IPS/IDS systems or Unified Threat Management (UTM) systems to cover a wider area of the neighbouring URLs where, without the analysis provided by the IITMAF, such systems can only block the front-facing URL content and the dynamically loaded content, and redirections would be omitted. Similarly, without the IITMAF, this analysis on the neighbouring URLs and the dynamic content would have to be performed by the analyst otherwise. Overall, the IITMAF provides a successful solution to the defined problem, providing cybersecurity professionals with both manual and automatic methodologies for identifying malware threats in the illicit IPTV ecosystem in addition to an automated solution for detecting, collecting, and analysing malware from illegal IPTV technologies. The IITMAF primarily aims to analyse illicit IPTV websites with its depth-first URL collection results. This functionality reveals possible external malvertising domains for an illicit website, including the loaded dynamic content. Although the URL and file analysis functionality meets the core requirements and detected a greater number of URLs as malicious than VirusTotal in this evaluation experiment, it has two minor limitations. One of these limitations is that for the submitted research sample in this evaluation experiment, only 4 out of the 60 URLs analysed had YARA rule matches indicating malicious capabilities. Nonetheless, 31 of the URLs had YARA rule matches for base64 encoded functions, implying that the static analysis functionality works properly. Additionally, one of the URLs pointing to an executable file had multiple YARA matches suggesting that it was malicious, as shown in Figure 11. This indicates that the signature-based malware detection functionality for IITMAF using YARA rules is still relevant and can detect malicious capabilities. The other limitation of the IITMAF analysis functionality is that it was unable to conduct dynamic analysis for ZIP files, as Hybrid Analysis does not automatically extract files from them. This suggests that the IITMAF has limitations when analysing illicit IPTV add-ons, as they are frequently distributed using ZIP files.