Q:

Are we a free malware analysis service?

Every so often we get questions about someone having found malware and wanting to know what it does. Essentially they are asking us to analyze the malware and tell them what it is. The latest one is here, about boring and awful PHP black hat SEO malware.
In my opinion, those questions are mostly useless:

there is an infinity of possible malware variants, so an answer wouldn't apply to anyone else, unless they find the exact same malware (which is getting rare as crooks use different obfuscators)
the author won't learn much just by reading someone else analysis. Maybe a canonical question "how to I reverse engineer X malware?", where X being the general category of malware (Windows, Linux, web, etc).

We should probably close those broad questions and only leave those asking more specific questions that could potentially have value to someone else later on (questions about a specific exploit, obfuscation method, etc). What do you think?

A:

Mark Buffalo worked up some canonical PHP malware answers with the process for analysis for the sole purpose of addressing this issue. We should point people to these questions (my internet on vacation is way too slow to search for them). 

A:

It seems to me as though the answers in that question are actually really useful, particularly to anyone else facing a similar issue.
So what is the actual harm to this community? 
If people can get value from the question and answers and there are people happy to provide clear answers, shouldn't this be encouraged?
I agree though that if a question is too broad to be able to provide a useful answer, then we should at least encourage the OP to reword the question.

A:

I think the question @schroeder recommended is a great canonical question.
But, and this is a big but: Just because we got ourself a fancy new hammer, we should not be fooled to believe that every question is a nail and hit the close button without thinking twice about it first:

Is the question not about what the malware does, but what should be done with the server once it is infected? Then there is another dup target for that.
Is the question about a specific problem with deobfuscating malware code, that is not covered by the canonical question? Then it is not a duplicate.
Is the question about why the malware does the things it does (and not how you deobfuscate it and read the code)? Then it is not a duplicate. I think this was the case with the one linked in this meta question. Closing that one would have deprived us of a good answer.

So please do not close just because you see an obfuscated code dump.

