Source: Juni_2026_Exams/Advance_Forensics/checklists/malware-analysis-exam-checklist.md

Malware Analysis Practical Exam Checklist

Before Execution

• [ ] Correct university VM loaded
• [ ] Clean snapshot restored
• [ ] Shared folders/clipboard/USB disabled
• [ ] Network isolated or FakeNet configured
• [ ] Sample path and SHA-256 recorded
• [ ] Screenshot folder and answer document ready

Static Triage

• [ ] CFF Explorer: PE type and architecture
• [ ] DiE/PEiD: packer/compiler indication
• [ ] Entropy recorded
• [ ] Sections and raw/virtual sizes checked
• [ ] Strings checked
• [ ] Imports/exports/resources checked
• [ ] Static observations labeled as hypotheses

ProcMon Capture

• [ ] Stop capture: Ctrl+E
• [ ] Clear old events: Ctrl+X
• [ ] Include sample process name
• [ ] Start capture before execution
• [ ] Stop capture after required behavior
• [ ] Save original trace before filtering further
• [ ] Check filesystem, registry, process, thread, and network operations
• [ ] Process Tree reviewed

API Analysis

• [ ] All APIMiner trace files preserved
• [ ] Target enumeration/opening APIs found
• [ ] Memory allocation/protection APIs found
• [ ] Payload write/map APIs found
• [ ] Thread execution/manipulation APIs found
• [ ] Relevant arguments/targets recorded
• [ ] API sequence explained, not merely listed

Reporting

• [ ] Every question answered directly
• [ ] Tool and command/filter stated
• [ ] Screenshot readable
• [ ] Relevant columns/path/API visible
• [ ] PID/TID copied accurately
• [ ] Observed facts separated from interpretation
• [ ] PDF uses required filename
• [ ] Final PDF opened and checked before submission