IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Advance_Forensics/notes/01-tooling-overview.md

Malware Analysis Tooling Overview

Safety First

Run lecture malware only inside the designated analysis VM:

another isolated topology

Core Exam Tools

Tool Primary purpose Evidence to capture
CFF Explorer PE structure, imports, exports, resources File type, headers, sections, API imports
Detect It Easy (DiE) Type/compiler/packer and entropy Architecture, packer indication, entropy
PEiD / PEview Packer signatures and PE fields Signature, section/raw-versus-virtual data
BinText / Strings Extract readable indicators Paths, URLs, IPs, commands, mutex names
ProcMon Filesystem, registry, process, thread, network events Filter, operation, path, PID/TID, result
Process Hacker Processes, parents, threads, modules, memory PID, parent, modules, memory regions
APIMiner Runtime API tracing API sequence and arguments
API Monitor Selected API call monitoring API names, parameters, return values

Supporting Tools

Tool Use
HashMyFiles / PowerShell Get-FileHash MD5/SHA hashes
ssdeep Similarity/fuzzy hashing
TrID / file Signature-based file identification
Resource Hacker Inspect and extract PE resources
Dependency Walker Imported DLLs and dependency chain
VMMap Process virtual-memory layout
Regshot Before/after registry comparison
Autoruns Enumerate persistence mechanisms
FakeNet Simulate DNS/HTTP services safely
Wireshark Packet capture and protocol analysis
ApateDNS Redirect/simulate DNS during isolated analysis
OllyDbg Entry-point and instruction-level inspection
VirusTotal Search by hash; upload only when permitted

For copy-paste commands and exact GUI paths for every lecture task, use the Complete Lecture Exercise Workbook.

Essential Command Checks

Run these before an exercise so you know whether the VM exposes the executable through PATH:

where ssdeep
where upx
where strings64
where sigcheck
where rundll32

If a command is not found, locate the supplied executable and use its full quoted path. Do not assume that installing a different version during the exam is permitted.

ssdeep

ssdeep -V
ssdeep file1.bin file2.bin
ssdeep -b file1.bin > baseline.hash
ssdeep -m baseline.hash file2.bin

UPX

upx -V
upx -t sample.exe
upx -o packed.exe original.exe
upx -d packed.exe -o unpacked.exe

Always work on copies and hash every version.

Standard Analysis Workflow

1. Preserve and identify

Get-FileHash C:\Temp\sample.exe -Algorithm SHA256

Record filename, size, SHA-256, source, and VM snapshot.

2. Static triage

  1. Open the sample in CFF Explorer.
  2. Confirm machine type and PE characteristics.
  3. Review sections and compare virtual/raw sizes.
  4. Open DiE and inspect detection plus entropy.
  5. Extract strings.
  6. Inspect imports, exports, and resources.
  7. Form hypotheses, not conclusions.

3. Prepare dynamic capture

  1. Restore the clean snapshot.
  2. Start ProcMon and stop capture with Ctrl+E.
  3. Clear old events with Ctrl+X.
  4. Add Process Name is sample.exe as an include filter.
  5. Add operation/path filters required by the question.
  6. Start Process Hacker and note the pre-execution process list.
  7. Start FakeNet/ApateDNS only when network behavior is being tested.

4. Execute and observe

  1. Start capture.
  2. Execute the sample using the privilege level specified by the exercise.
  3. Wait only long enough to observe the required behavior.
  4. Stop capture.
  5. Save the ProcMon trace before changing filters.
  6. Examine Process Tree, files, registry, threads, and network events.

5. Trace APIs

Run the VM-provided APIMiner command. The 2025 answer used:

C:\Users\IEUser\Desktop\APIMiner.lnk --app C:\Temp\sample.exe

Open all generated trace files and search for API families related to:

6. Correlate and report

Correlate static imports, runtime API calls, ProcMon operations, Process Hacker observations, and created artifacts. Include screenshots that show the tool, filter or command, and result.

Tool Limitations

GetProcAddress.