Source: Juni_2026_Exams/Advance_Forensics/notes/00-focus-points.md

Focus Points - Source-Backed Priorities

Evidence Base

This priority list is based on:

• seven uploaded lecture PDFs, dated for the 2026 course
• Exams2025_Malware_Analysis-2.pdf
• Exams2025_Malware_Analysis_Answers.pdf

The 2025 practical exam used a Windows VM and one executable, C:\Temp\sample.exe. Students had to provide screenshots for every answer.

Tier 1: Must Master

Spend about 60 percent of preparation time here.

Static PE triage

Be able to:

• identify whether a file is PE32/PE32+
• inspect DOS, NT, File, Optional, section, import, export, and resource data
• determine likely packing using multiple indicators
• calculate and interpret entropy
• compare virtual size with raw size
• inspect strings, imports, compilation timestamp, and resources

Primary tools:

• CFF Explorer
• Detect It Easy (DiE)
• PEiD and PEview where provided in the VM
• BinText or Strings
• Resource Hacker
• Dependency Walker

Dynamic behavior with ProcMon

Be able to:

• start with a clean capture
• filter by process name
• identify CreateFile, WriteFile, rename, and delete activity
• inspect process/thread events
• identify registry, filesystem, process, and network behavior
• use Process Tree and preserve screenshots

The 2025 exam specifically asked which files were created in C:\Temp and which thread IDs appeared.

API tracing and process injection

Master the purpose and sequence of:

1. Target discovery/opening:

CreateToolhelp32Snapshot, Process32First/Next, OpenProcess, or process creation in a suspended state.

1. Remote memory allocation/protection:

VirtualAllocEx, VirtualAlloc, VirtualProtect, NtAllocateVirtualMemory, or section-mapping APIs.

1. Payload/path writing or mapping:

WriteProcessMemory, NtCreateSection, NtMapViewOfSection, NtUnmapViewOfSection.

1. Execution:

CreateRemoteThread, NtCreateThreadEx, QueueUserAPC, SetThreadContext, ResumeThread, or related thread APIs.

Primary tools:

• APIMiner
• API Monitor
• ProcMon
• Process Hacker
• CFF Explorer

Do not memorize only one “correct” API chain. The lecture and 2025 answer use multiple injection variants.

Evidence reporting

Every answer should contain:

• direct answer
• exact tool and filter/command
• screenshot with relevant result visible
• observed API, path, PID, or TID
• explanation connecting the evidence to the conclusion
• limitation when evidence is indirect

Tier 2: Strongly Recommended

Spend about 30 percent of preparation time here.

Hashing and file identification

• MD5, SHA-1, SHA-256
• hash invariance after rename
• collision limitations
• VirusTotal hash search versus uploading confidential files
• ssdeep/fuzzy hashing
• import hash
• magic bytes, TrID, and misleading extensions

PE and memory structure

• little endian representation
• e_lfanew and PE signature
• machine type and characteristics
• ImageBase, RVA, VA, and AddressOfEntryPoint
• sections on disk versus memory
• imports, exports, modules, and dependencies
• memory inspection with Process Hacker and VMMap

Persistence

• Startup folders
• Run/RunOnce keys
• services
• scheduled tasks
• DLL search-order hijacking
• AppInit DLLs and shortcut hijacking
• verification using Autoruns, ProcMon, registry queries, and event logs

Network behavior

• FakeNet for simulated DNS/HTTP services
• Wireshark capture and TLS-key-log decryption
• DGA and NXDOMAIN patterns
• HTTP C2 indicators
• networking imports and API context

Tier 3: Learn After the Practical Workflow

Spend about 10 percent of preparation time here:

• detailed manual disassembly
• all injection variants beyond the lecture exercises
• advanced TLS fingerprinting
• rootkits and kernel injection
• lengthy malware taxonomy

These topics matter, but the verified 2025 exam rewarded practical tool use, API interpretation, and screenshots.

Tool Mastery Test

You are ready when you can perform this from a clean VM snapshot:

1. Hash a sample and identify its type.
2. Inspect it in CFF Explorer and DiE.
3. justify whether it is packed using at least two indicators.
4. Start ProcMon, clear events, configure useful filters, and execute safely.
5. List created/deleted files with full paths.
6. Run APIMiner and locate injection-related APIs and parameters.
7. Use Process Hacker/ProcMon to identify target processes, PIDs, and TIDs.
8. Produce a short PDF answer with readable screenshots.

Recommended Study Order

1. Lab isolation and snapshots.
2. Hashes and file type.
3. PE headers, sections, imports, strings, and resources.
4. Packing and entropy.
5. ProcMon filtering and Process Hacker.
6. APIMiner/API Monitor.
7. Process injection stages and API families.
8. Persistence.
9. FakeNet and Wireshark.
10. Timed reconstruction of the 2025 exam.

See:

• notes/13-lecture-exercises-step-by-step.md
• solutions/exam-2025-verified-walkthrough.md
• checklists/malware-analysis-exam-checklist.md