Analysis of hostile code. How to deal with packer and how to figure out the language it is written on? : <p>I received a tailored email with an infected attachment from a public email. I would like to more about the payload. What is the right way to study this? I would like to use a debugger. Easier, but riskier option is to run it on Windows guest/Linux host on a sacrificial box without wifi card and comparing disk images before and after infection.
If I go the debugger way, how should I unpack the code?<br>
How to tell in what language the malware was written?<br>
Can any code be debugged by changing defensive conditional jumps (like "if debugger present" jump, or there are other pitfalls?<br>
How likely is it for malware jailbreak vmware and infect Linux host? </p>
