Course 42 - Mobile Malware Analysis Fundamentals | Episode 7: Malware Tools and Practical Lab Walkthrough — CyberCode Academy

iOS Basic Static Analysis — Advanced Study GuideThis episode moves from the fundamentals of iOS malware analysis into hands-on static binary analysis, demonstrating how command-line utilities and reverse-engineering tools can reveal valuable information without executing the malware.1. otool — Inspecting Mach-O Binariesotool is one of the most useful command-line utilities for examining Apple Mach-O binaries.A particularly important option is:otool -L application This displays the dynamic libraries linked by the executable.Analyzing these libraries can provide early clues about the application's functionality and dependencies.For example, an analyst may investigate whether an application relies on libraries associated with:

Networking
Cryptography
User interfaces
System services
Other potentially interesting functionality

2. nm — Examining SymbolsThe nm utility displays symbols contained within a binary.This can help analysts identify:

Functions
Global symbols
External references
Potentially interesting APIs

Searching symbols for security-sensitive functions can provide useful leads for further investigation.The important principle is:Symbols don't prove malicious behavior, but they can help identify where to investigate.3. Identifying Objective-C vs. SwiftThe language used to develop an iOS application can sometimes be inferred from characteristics of its compiled binary.Objective-CObjective-C applications commonly expose recognizable:

Class names
Method names
Objective-C runtime metadata
Selector information

SwiftSwift uses name mangling, meaning function and symbol names may appear in encoded or transformed forms.Older Swift binaries can contain recognizable mangling patterns such as _T.However, analysts should avoid relying on a single indicator because modern binaries can contain a mixture of:

Swift
Objective-C
C/C++
Third-party frameworks

4. Class DumpingClass-dumping tools can help reconstruct information about Objective-C classes from compiled binaries.Conceptually:Mach-O Binary ↓ Objective-C Metadata ↓ Classes / Methods ↓ Potential Application Logic This can give an analyst an initial understanding of the application's internal architecture without immediately performing full reverse engineering.5. Disassembly and Reverse EngineeringFor deeper analysis, tools such as Hopper and IDA Pro can be used to examine the binary at the assembly level.A typical workflow is:IPA ↓ Mach-O Executable ↓ Disassembly ↓ Functions ↓ Control-Flow Analysis ↓ Decompilation ↓ Behavioral Understanding These tools can help researchers:

Locate functions
Search strings
Follow cross-references
Visualize control flow
Examine assembly instructions
Generate higher-level pseudocode

The goal isn't simply to read assembly—it is to reconstruct the program's logic.6. Initial Malware TriageBefore performing extensive analysis, the episode demonstrates basic malware triage.A useful first step is generating a cryptographic hash of the sample.For example:md5 malware.ipa The resulting hash can be used as a sample identifier when checking authorized malware-intelligence resources.The general workflow is:Sample ↓ Hash ↓ Threat Intelligence Lookup ↓ Existing Detections / Reputation ↓ Initial Context A hash lookup can provide useful context, but a lack of detections does not mean that the file is safe.7. Extracting the IPAAn IPA can be extracted to expose its internal application structure.Conceptually:malware.ipa ↓ Payload/ ↓ malware.app/ ├── executable ├── Info.plist ├── Frameworks/ └── Resources/ The executable and Info.plist are particularly valuable during initial triage.8. Analyzing Info.plistThe episode uses plutil to inspect the application's property-list information.For example:plutil -p Info.plist The analyst can use this information to investigate:

Bundle identifier
Application metadata
Executable name
Application configuration
Supported capabilities
Potentially suspicious settings

9. Hidden Application BehaviorOne particularly interesting discovery in the lab is the discrepancy between the executable's internal identity and how the application presents itself to the user.The executable is associated with "no icon", while the application presents itself as "passbook" and contains configuration indicating a hidden icon.This type of inconsistency is valuable during malware triage because it raises questions about the application's intended behavior.An analyst should ask:

Why is the application attempting to hide?
Why does its internal naming differ from its apparent identity?
What functionality is being concealed?
Does the application attempt to maintain persistence?
What happens when it executes?

These questions form the basis of the behavioral hypothesis.10. String AnalysisExtracting strings from a binary is another useful early-stage technique.Conceptually:Binary ↓ Strings ↓ URLs IPs File Paths Commands Configuration Identifiers ↓ Behavioral Hypothesis Strings can reveal:

Domains
URLs
IP addresses
File paths
Error messages
Configuration values
API endpoints
Debug information

However, strings must be treated carefully because they can be:

Obfuscated
Encoded
Unused
Dynamically constructed

Therefore, d