Source: Juni_2026_Exams/Advance_Forensics/notes/01-tooling-overview.md
Malware Analysis Tooling Overview
Safety First
Run lecture malware only inside the designated analysis VM:
- start from a clean snapshot
- disable shared clipboard, drag-and-drop, shared folders, and USB
- use host-only/internal networking unless the lecturer explicitly requires
another isolated topology
- use FakeNet or another simulator instead of unrestricted Internet access
- never execute samples on the host or a production system
- restore the snapshot after each exercise
Core Exam Tools
| Tool | Primary purpose | Evidence to capture |
|---|---|---|
| CFF Explorer | PE structure, imports, exports, resources | File type, headers, sections, API imports |
| Detect It Easy (DiE) | Type/compiler/packer and entropy | Architecture, packer indication, entropy |
| PEiD / PEview | Packer signatures and PE fields | Signature, section/raw-versus-virtual data |
| BinText / Strings | Extract readable indicators | Paths, URLs, IPs, commands, mutex names |
| ProcMon | Filesystem, registry, process, thread, network events | Filter, operation, path, PID/TID, result |
| Process Hacker | Processes, parents, threads, modules, memory | PID, parent, modules, memory regions |
| APIMiner | Runtime API tracing | API sequence and arguments |
| API Monitor | Selected API call monitoring | API names, parameters, return values |
Supporting Tools
| Tool | Use |
|---|---|
HashMyFiles / PowerShell Get-FileHash |
MD5/SHA hashes |
| ssdeep | Similarity/fuzzy hashing |
TrID / file |
Signature-based file identification |
| Resource Hacker | Inspect and extract PE resources |
| Dependency Walker | Imported DLLs and dependency chain |
| VMMap | Process virtual-memory layout |
| Regshot | Before/after registry comparison |
| Autoruns | Enumerate persistence mechanisms |
| FakeNet | Simulate DNS/HTTP services safely |
| Wireshark | Packet capture and protocol analysis |
| ApateDNS | Redirect/simulate DNS during isolated analysis |
| OllyDbg | Entry-point and instruction-level inspection |
| VirusTotal | Search by hash; upload only when permitted |
For copy-paste commands and exact GUI paths for every lecture task, use the Complete Lecture Exercise Workbook.
Essential Command Checks
Run these before an exercise so you know whether the VM exposes the executable through PATH:
where ssdeep
where upx
where strings64
where sigcheck
where rundll32
If a command is not found, locate the supplied executable and use its full quoted path. Do not assume that installing a different version during the exam is permitted.
ssdeep
ssdeep -V
ssdeep file1.bin file2.bin
ssdeep -b file1.bin > baseline.hash
ssdeep -m baseline.hash file2.bin
- plain
ssdeepgenerates signatures -bremoves directory information from generated signatures-mcompares files against signatures stored in a hash file
UPX
upx -V
upx -t sample.exe
upx -o packed.exe original.exe
upx -d packed.exe -o unpacked.exe
Always work on copies and hash every version.
Standard Analysis Workflow
1. Preserve and identify
Get-FileHash C:\Temp\sample.exe -Algorithm SHA256
Record filename, size, SHA-256, source, and VM snapshot.
2. Static triage
- Open the sample in CFF Explorer.
- Confirm machine type and PE characteristics.
- Review sections and compare virtual/raw sizes.
- Open DiE and inspect detection plus entropy.
- Extract strings.
- Inspect imports, exports, and resources.
- Form hypotheses, not conclusions.
3. Prepare dynamic capture
- Restore the clean snapshot.
- Start ProcMon and stop capture with
Ctrl+E. - Clear old events with
Ctrl+X. - Add
Process Name is sample.exeas an include filter. - Add operation/path filters required by the question.
- Start Process Hacker and note the pre-execution process list.
- Start FakeNet/ApateDNS only when network behavior is being tested.
4. Execute and observe
- Start capture.
- Execute the sample using the privilege level specified by the exercise.
- Wait only long enough to observe the required behavior.
- Stop capture.
- Save the ProcMon trace before changing filters.
- Examine Process Tree, files, registry, threads, and network events.
5. Trace APIs
Run the VM-provided APIMiner command. The 2025 answer used:
C:\Users\IEUser\Desktop\APIMiner.lnk --app C:\Temp\sample.exe
Open all generated trace files and search for API families related to:
- target discovery/opening
- privilege adjustment
- memory allocation/protection
- payload writing/section mapping
- thread manipulation/execution
6. Correlate and report
Correlate static imports, runtime API calls, ProcMon operations, Process Hacker observations, and created artifacts. Include screenshots that show the tool, filter or command, and result.
Tool Limitations
- ProcMon operations are not a one-to-one list of Win32 APIs.
- Static imports miss runtime linking through
LoadLibraryand
GetProcAddress.
- Packed code may expose useful APIs only after unpacking in memory.
- Entropy near 8 supports packing/encryption but does not prove maliciousness.
- A compilation timestamp can be forged.
- VirusTotal nondetection does not prove a file is safe.
- Process/thread IDs vary on every run; report the IDs from your own capture.