From a workflow perspective, the new plugin version also streamlines tedious aspects of deep-dive analysis such as unpacking, de-obfuscating, and organizing malware files and runtime artifacts such as memory dumps. Now Version 1.1 of the plugin, released in August, allows analysts to work immediately and directly with smart memory dumps, which reveal far more information about malware behavior than static analysis alone can provide. This feature triggers more frequent and contextually relevant memory dumps, capturing a more complete, accurate record of malware behavior, down to the exact function calls and corresponding memory addresses. The value of the plugin was boosted this past May, when we rolled out VMRay Analyzer 3.0, with smart memory dumping.

The plugin sped up in-depth analysis of malware threats by adding comments to dynamically resolved API calls within IDA, showing the resolved function, its parameters, return value and timestamp. With Version 1.0 of the plugin (nicknamed IDARay), malware analysts and DFIR teams could use the output of VMRay Analyzer to enrich IDA Pro static analysis with behavior-based data. A year ago this fall, we introduced the VMRay Analyzer IDA plugin for IDA Pro disassembler and decompiler.

Ida pro plugin