Source: Juni_2026_Exams/Advance_Forensics/notes/16-exam-terms-and-tools-glossary.md

Exam Terms and Tools Glossary

How to Use This File

Use this document when the exam asks:

• What does this term mean?
• Is this file packed or unpacked?
• What file or process type is this?
• Which tool should I use?
• What evidence proves my conclusion?

For each concept, remember:

Definition -> Indicators -> Tool -> Evidence -> Limitation

Never conclude that a file is malicious from one indicator alone.

High-Priority Distinctions

Analysis Types

Static Analysis

Definition: Examination without running the sample.

What it can show:

• hash and file type
• PE architecture and headers
• sections, entropy, imports, exports, and resources
• strings and possible indicators
• likely compiler or packer

Tools: CFF Explorer, DiE, PEiD, PEview, Strings/BinText, Resource Hacker, Dependency Walker.

Good answer:

Static analysis shows that the sample is a PE32 executable with high entropy, unusual sections, few imports, and limited strings. These indicators support packing, but do not prove malicious behavior.

Dynamic Analysis

Definition: Observation while the sample executes in an isolated VM.

What it can show:

• files and registry values created
• processes and threads
• runtime APIs
• memory-only strings or unpacked code
• DNS, HTTP, and other network behavior

Tools: ProcMon, Process Hacker, APIMiner, API Monitor, Regshot, FakeNet, Wireshark.

Limitation: A behavior may not execute because it requires arguments, privileges, time, a network response, or a specific environment.

Behavioral Correlation

Definition: Combining independent sources to support one conclusion.

Example:

Static import: RegSetValue
APIMiner: RegSetValue called with a Run key
ProcMon: RegSetValue on exact path
Autoruns: new autostart entry

This is stronger than any one observation.

Hash and Identity Terms

Cryptographic Hash

Definition: Fixed-length fingerprint calculated from file bytes.

Get-FileHash C:\Temp\sample.exe -Algorithm SHA256
Get-FileHash C:\Temp\sample.exe -Algorithm SHA1
Get-FileHash C:\Temp\sample.exe -Algorithm MD5

Key facts:

• rename does not change the hash
• changing content normally changes the hash
• SHA-256 is preferred for evidence identity
• MD5 and SHA-1 have collision weaknesses

Hash Collision

Definition: Two different inputs produce the same hash value.

Exam point: A shared MD5 does not guarantee two files are identical. Check SHA-256, file size, and content.

Fuzzy Hash / ssdeep

Definition: Similarity signature designed to identify related but non-identical content.

ssdeep -b original.bin > original.hash
ssdeep -m original.hash candidate.bin

Interpretation:

• higher score means greater binary similarity
• no match does not prove unrelated semantic content
• compressed formats such as DOCX can produce poor comparisons
• small files may not provide stable matching blocks

Import Hash / imphash

Definition: MD5 derived from normalized, ordered PE imports.

Use: Finding samples built from similar code/import tables.

Tools: PEStudio, pefile, VirusTotal, Sysmon when configured.

Limitation: Packing, dynamic imports, changed import order, and common imports can reduce reliability.

File-Type Terms

File Extension

The suffix such as .exe, .dll, or .pdf. It can be renamed and is not proof of content.

Magic Bytes / File Signature

Bytes at a known location that support a file-type identification.

Format-Hex C:\Temp\sample.exe | Select-Object -First 4

PE / Portable Executable

Windows executable format used by EXE, DLL, SCR, SYS, and related files.

EXE

Executable image normally launched directly. In CFF Explorer, inspect File Header characteristics and Optional Header subsystem.

DLL

Library loaded by another process. It normally exports functions and may require a host such as rundll32.exe.

rundll32.exe C:\Temp\sample.dll,<ExportName>

The DLL characteristic in the PE File Header is stronger evidence than the extension.

PE32 vs PE32+

Use CFF Explorer or DiE. Do not call PE32+ “PE64” in a formal header answer.

Machine Type

File Header value identifying the target architecture, such as x86 or x64. Changing it to an incompatible value can make Windows reject the image.

File-Type Mismatch

The extension suggests one type while magic bytes/structure show another.

Answer example:

Although the filename ends in .pdf, the file begins with MZ and contains a valid PE header. It is therefore a Windows PE executable, not a PDF.

PE Structure Terms

DOS Header

Legacy header at the start of a PE. It contains e_magic and e_lfanew.

e_magic

The DOS signature corresponding to MZ (4D 5A on disk).

e_lfanew

Four-byte little-endian value at file offset 0x3C pointing to the PE header.

Little Endian

Least-significant byte stored first. A multi-byte numeric value may look reversed in a hex editor.

NT Headers

PE signature plus File Header and Optional Header.

File Header

Contains Machine, NumberOfSections, TimeDateStamp, and Characteristics.

Optional Header

Required for executable images despite its name. Contains entry point, ImageBase, alignments, SizeOfImage, subsystem, and data-directory locations.

ImageBase

Preferred virtual address where the image should load.

RVA

Relative Virtual Address: offset from the image's actual base.

VA

Virtual Address in process memory:

VA = actual ImageBase + RVA
RVA = VA - actual ImageBase

File Offset

Position in the file on disk. It is not interchangeable with an RVA.

AddressOfEntryPoint

RVA of the first program instruction executed after loading.

Section

Named PE region with code or data.

VirtualSize vs SizeOfRawData

• VirtualSize: space required when mapped into memory
• SizeOfRawData: bytes stored in the file

A large difference can support packing/unpacking, but is not proof alone.

Section Permissions

Common permissions: Read (R), Write (W), Execute (X).

RWX is suspicious when unexpected because memory is writable and executable, but legitimate software can also use it.

Import Table / IAT

List of DLLs/functions the PE expects to use. Static imports show capability. Runtime resolution through LoadLibrary/GetProcAddress may hide APIs.

Export Directory

Functions a DLL or EXE exposes by name or ordinal.

Resource

Embedded object such as an icon, dialog, configuration, script, or another PE.

Tool: Resource Hacker.

Proof of embedded PE: exported resource begins MZ and parses as PE.

Compilation Timestamp

File Header TimeDateStamp associated with linking. It can be forged, copied, or altered and should be reported with a caveat.

Packing and Protection Terms

Packed File

Definition: Original code/data is compressed or transformed and restored by a loader stub at runtime.

Indicators:

• high entropy
• packer signature
• unusual sections such as UPX0
• large raw/virtual-size differences
• very few imports
• few meaningful strings
• entry point inside an unusual section

Tools: DiE, PEiD, CFF Explorer, PEview, Strings.

Defensible answer:

The file is likely packed because DiE reports entropy of [value], [DiE/PEiD] identifies [signature], and the section table shows [indicator]. These combined indicators support packing; entropy alone would not prove it.

Unpacked File

Code, imports, and strings are directly available in the file to a greater extent. “Not detected as packed” does not prove no obfuscation exists.

Entropy

Measure of byte randomness, commonly from 0 to 8.

• near 8 supports compression or encryption
• ordinary code/data is generally lower
• high entropy is not proof of malware

Packer

Tool that wraps/compresses an executable and adds an unpacking stub. UPX is a common legitimate and maliciously used packer.

upx -t sample.exe
upx -d sample.exe -o sample-unpacked.exe

Crypter

Transforms/encrypts payload content primarily to hide it and evade detection.

Protector

Adds anti-analysis, anti-debugging, virtualization, or integrity checks in addition to possible packing/encryption.

Obfuscation

Transformation that makes code/data harder to understand while retaining functionality. Examples include encoded strings, confusing control flow, and dynamic API resolution.

Runtime Unpacking

Packed content is restored into process memory during execution.

Evidence: meaningful strings/code appear in memory but not on disk; allocation/write/protection changes occur before execution transfers.

Malware-Role Terms

Dropper

Carries another payload inside itself and writes it to disk.

Evidence: embedded resource plus runtime file creation/writing.

Downloader

Retrieves a payload from a network location.

Indicators: URLDownloadToFile, WinINet/WinHTTP APIs, HTTP requests, and a new downloaded file.

Loader

Loads or executes another payload, often directly in memory.

Backdoor

Provides unauthorized remote access or command execution.

Trojan

Malicious program presented as legitimate or useful software.

Ransomware / File Encryptor

Modifies/encrypts user files and may rename them or add extensions.

Proof: before/after hash/content changes plus write/rename operations. Extension change alone is insufficient.

Worm

Self-propagates between systems without requiring normal user distribution.

C2 / Command and Control

Infrastructure/protocol used for malware commands, responses, and data.

Mutex / Mutant

Named synchronization object often used to prevent duplicate infections or coordinate threads.

API: CreateMutex or native NtCreateMutant.

A mutex name can be an indicator, but is not uniquely malicious.

DGA

Domain Generation Algorithm that creates candidate domains for C2.

Evidence: repeated generated domains, algorithmic patterns, periodic DNS, and many NXDOMAIN responses.

Process and Memory Terms

Program

Executable file stored on disk.

Process

Running program instance with a PID, virtual address space, handles, modules, and one or more threads.

Parent Process

Process that created another process.

Tools: Process Hacker, ProcMon Process Tree.

Parentage provides execution context, not automatic proof of legitimacy.

Child Process

Process created by another process. Unexpected parent-child relationships can be suspicious.

PID / Process ID

Runtime identifier assigned to a process. It changes between runs.

Thread

Execution unit inside a process. Threads share the process address space.

TID / Thread ID

Runtime identifier assigned to a thread. It changes between runs.

Process Integrity Level

Windows trust/privilege boundary such as Low, Medium, High, or System.

Module

EXE or DLL mapped into a process. Inspect in Process Hacker's Modules tab.

Virtual Memory

Per-process address space mapped by Windows to physical memory or backing storage.

Memory Page

Fixed-size virtual-memory unit, commonly 4 KB.

Committed Memory

Memory with backing resources allocated.

Reserved Memory

Address range set aside without all backing storage committed.

Private Memory

Memory belonging to one process rather than a mapped file/image. Private executable regions can support injection or runtime unpacking.

Mapped File

File contents mapped into virtual memory.

Image Memory

Mapped executable image such as an EXE or DLL.

Heap

Dynamic process memory used for runtime allocations.

Stack

Per-thread memory for calls, local variables, and control data.

Handle

Process-specific reference to an operating-system object such as a process, file, registry key, or mutex.

Suspended Process/Thread

Created or paused without executing instructions. CREATE_SUSPENDED is used legitimately and in process injection/hollowing.

Process-Injection Terms

Process Injection

Running code inside another process's address space.

Four stages:

Classic DLL Injection

Writes a DLL path into the target and creates a thread that calls LoadLibrary.

OpenProcess
VirtualAllocEx
WriteProcessMemory
GetProcAddress(LoadLibrary)
CreateRemoteThread

Confirmation: unexpected DLL appears in target Modules tab.

Shellcode Injection

Writes raw executable instructions into target memory and executes them.

OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
CreateRemoteThread

Process Hollowing

Creates a legitimate process suspended, replaces/unmaps its image or code, changes thread context, and resumes it.

CreateProcess(CREATE_SUSPENDED)
NtUnmapViewOfSection
VirtualAllocEx / NtMapViewOfSection
WriteProcessMemory
SetThreadContext
ResumeThread

CREATE_SUSPENDED alone does not prove hollowing.

Section Mapping

Creates/maps a shared memory section into processes using APIs such as NtCreateSection and NtMapViewOfSection.

Remote Thread

Thread created in another process, commonly with CreateRemoteThread or NtCreateThreadEx.

APC Injection

Queues code to a thread using QueueUserAPC; execution requires the target thread to enter an alertable state.

DLL Search-Order Hijacking

Places a malicious DLL where an application searches before the legitimate DLL. Evidence requires the search path, matching DLL name, and observed load.

API Terms and Categories

API

Application Programming Interface used by programs to request operating-system or library functionality.

Win32 API vs Native API

• Win32 APIs are documented user-mode functions such as CreateProcess.
• Native APIs commonly begin Nt/Zw, such as NtMapViewOfSection.

Dynamic API Resolution

Using LoadLibrary and GetProcAddress at runtime instead of listing every function in the static import table.

Common API Families

API Hooking

Monitoring/intercepting API calls by redirecting execution through analysis code. APIMiner and API Monitor depend on this type of visibility.

Direct Syscall

Program invokes kernel services without the expected monitored Win32 path. This can reduce API-monitor visibility.

API Hammering

Large numbers of irrelevant API calls used to delay or hide meaningful behavior.

Persistence Terms

Persistence

Mechanism that causes code to run again after process termination, logon, restart, or another trigger.

Run / RunOnce Keys

Registry autostart values:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Run executes at logon; RunOnce is normally removed after execution.

Startup Folder

Files/shortcuts launched at user logon.

shell:startup
shell:common startup

Service Persistence

Service configured to run a binary, often automatically at boot.

sc.exe qc <ServiceName>
reg query HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>

Scheduled Task

Action launched by time, event, logon, boot, or another trigger.

schtasks /query /fo list /v

AppInit DLLs

Configured DLLs loaded into processes that load user32.dll, subject to Windows security settings.

BootExecute

Session Manager value containing programs run early during boot. Normal data commonly includes autocheck autochk *.

Autorun

General term for mechanisms that launch software automatically. Autoruns is also the Sysinternals tool that enumerates many such mechanisms.

Network Terms

DNS

Maps domain names to records/IP addresses.

NXDOMAIN

DNS response indicating the requested name does not exist. Many periodic NXDOMAIN responses can support inactive DGA behavior.

Beaconing

Repeated communication at regular or patterned intervals.

HTTP C2

C2 traffic encoded in HTTP requests/responses, including paths, headers, parameters, cookies, or bodies.

TLS

Encrypts application data in transit. Endpoints, ports, timing, sizes, and some handshake metadata remain observable.

SSL Key Log

File containing session secrets that may allow Wireshark to decrypt matching TLS sessions.

PCAP / PCAPNG

Packet-capture file. Preserve the original before applying display filters.

FakeNet

Simulates DNS and network services in the isolated VM and logs requests.

ApateDNS

Redirects/simulates DNS responses for malware analysis.

Evidence Terms

Indicator of Compromise / IOC

Observable artifact associated with possible compromise: hash, path, domain, IP, mutex, registry value, service, or task.

An IOC is a lead and can produce false positives.

Host-Based Indicator

Artifact on the endpoint: file, path, registry value, process, mutex, service.

Network-Based Indicator

Domain, IP, URL, user agent, protocol pattern, or destination port.

False Positive

Benign item incorrectly classified as suspicious.

False Negative

Malicious item missed by the detection method.

Baseline

Known pre-execution state used for before/after comparison.

Corroboration

Independent evidence supporting the same conclusion.

Chain of Custody

Record of evidence acquisition, handling, transfer, and integrity.

Volatile Evidence

Evidence that changes/disappears, such as processes, memory, connections, PID, and TID values.

Artifact

Data left by system or user activity that can support reconstruction.

Supplemental Disk-Forensics Terms

Forensic Image

Bit-for-bit acquisition of a storage device, commonly E01 or raw/DD.

Registry Hive

On-disk registry database such as SYSTEM, SOFTWARE, SAM, NTUSER.DAT, or UsrClass.dat.

Transaction Logs

.LOG1/.LOG2 files used to replay recent registry changes.

CurrentControlSet

Logical SYSTEM hive alias selected through Select\Current. In offline analysis, resolve it to ControlSet001, ControlSet002, and so on.

MFT

NTFS Master File Table containing records for files/directories, including allocated and deleted entries.

MACB Timestamps

Modified, Accessed, Created, and MFT-entry-changed timestamps.

LNK File

Windows shortcut containing target path, volume, and timestamp information.

Prefetch

Windows execution optimization artifact that can support program-execution history.

UserAssist

NTUSER.DAT artifact recording GUI program execution; names are ROT13 encoded.

RecentDocs

NTUSER.DAT artifact recording recently accessed document names/extensions.

Complete Tool Map

CFF Explorer

Use for: PE type, architecture, headers, sections, imports, exports, resources.

File -> Open
DOS Header -> e_magic/e_lfanew
NT Headers -> File Header
NT Headers -> Optional Header
Section Headers
Import Directory
Export Directory
Resource Directory

Capture: field name, value, file/sample name, and relevant tree location.

Detect It Easy / DiE

Use for: file type, architecture, compiler/packer signature, entropy.

Open file
Review Detection
Review Entropy
Review PE sections

Do not conclude “packed” from entropy alone.

PEiD

Use for: legacy packer/compiler signatures and entropy-related checks.

Check userdb.txt when the default signature set finds nothing.

PEview

Use for: low-level PE headers, section raw/virtual values, compile timestamp.

Strings / BinText

Use for: paths, URLs, IPs, commands, mutexes, messages, and API names.

strings64.exe -n 4 C:\Temp\sample.exe > C:\Temp\Results\strings.txt
findstr /i "http ftp cmd powershell" C:\Temp\Results\strings.txt

Strings are leads; runtime evidence confirms use.

Resource Hacker

Use for: enumerate and export PE resources.

Open sample
Expand resource tree
Right-click resource
Save resource to binary file

Hash and identify the exported object.

Dependency Walker

Use for: direct dependencies, dependency chains, and runtime profiling.

depends.exe C:\Temp\sample.exe

Use Profile -> Start Profiling for dynamic loads.

UPX

Use for: test, pack, or unpack UPX files.

upx -t sample.exe
upx -d sample.exe -o sample-unpacked.exe

Always use a copy and hash both versions.

ProcMon

Use for: filesystem, registry, process/thread, image-load, and network operations.

Ctrl+E -> start/stop
Ctrl+X -> clear
Ctrl+L -> filters
Tools -> Process Tree

Core filters:

Process Name is sample.exe -> Include
Path begins with C:\Temp -> Include
Operation is WriteFile -> Include
Operation is RegSetValue -> Include
Operation contains Thread -> Include

Save the complete PML before narrowing filters.

Process Hacker

Use for: process tree, PID/parent, path, command line, integrity, modules, threads, memory, and memory strings.

Double-click process
General -> path/parent/command line
Modules -> loaded DLLs
Threads -> TIDs/start addresses
Memory -> regions/protections/strings

VMMap

Use for: memory types and committed/reserved totals.

"C:\Program Files\Sysinternals\vmmap.exe"

APIMiner

Use for: runtime APIs, arguments, return values, and injection sequences.

C:\Users\IEUser\Desktop\APIMiner.lnk --app C:\Temp\sample.exe

Search traces:

Select-String -Path C:\Temp\*.txt -Pattern 'OpenProcess|VirtualAllocEx|WriteProcessMemory|CreateRemoteThread' -Context 4,10

API Monitor

Use for: interactively selecting API categories and inspecting calls, parameters, and returns.

Select API filters
Monitor New Process
Choose sample
Run
Inspect Summary and Call Tree

Regshot

Use for: broad before/after registry and filesystem comparison.

1st shot
Run sample
2nd shot
Compare

Correlate differences with ProcMon for process attribution.

Autoruns

Use for: Run keys, Startup folders, services, tasks, AppInit, and other autostart entries.

Disable “Hide Microsoft Entries” when the exercise requires a complete view.

FakeNet

Use for: simulate DNS/HTTP/network services safely.

Start FakeNet before the sample and preserve its log.

Wireshark

Use for: packet-level DNS, HTTP, TCP, and TLS analysis.

dns
dns.flags.rcode == 3
http
http.request
tls
tcp.stream eq <number>

ApateDNS

Use for: redirect requested domains to the analysis VM and log DNS requests.

OllyDbg

Use for: entry-point and instruction-level inspection.

Load the sample and compare the initial code address with:

actual ImageBase + AddressOfEntryPoint RVA

HashMyFiles / Get-FileHash

Get-FileHash C:\Temp\sample.exe -Algorithm SHA256

ssdeep

ssdeep -b original.bin > original.hash
ssdeep -m original.hash candidate.bin

TrID

Use for: signature-based type identification independent of extension.

trid C:\Temp\sample

VirusTotal

Search by SHA-256 first. Upload only when the sample is not confidential and permission explicitly allows it. Detection count alone is not proof.

FTK Imager

Use for: open forensic images and export files/hives without modifying the source.

Registry Explorer

Use for: offline hive parsing, transaction-log replay, keys, values, and timestamps.

MFT Explorer

Use for: NTFS records, deleted entries, full paths, and MACB timestamps.

DCode

Use for: FILETIME, Unix, DOS, and other timestamp conversion. Always state timezone.

Fast Question-to-Tool Map

Answer Language

Use cautious evidence language:

Supports:
The evidence supports that...

Confirms:
The runtime trace confirms that this API executed with...

Suggests:
The import/string suggests capability, but runtime use was not observed.

Does not prove:
High entropy alone does not prove packing or maliciousness.
VirtualAllocEx alone does not prove complete process injection.
CreateFile alone does not prove a new file was created.
A Run key alone does not prove the target executed successfully.

Final Self-Test

You should be able to answer without looking:

1. What is the difference between PE32 and PE32+?
2. Which three independent indicators can support packing?
3. What is the difference between file offset, RVA, and VA?
4. What is the difference between a process, thread, PID, and TID?
5. What are the four process-injection stages?
6. Which evidence distinguishes DLL injection from shellcode injection?
7. Why does CreateFile not automatically mean “file created”?
8. What proves persistence configuration versus successful execution?
9. What is the difference between a dropper and downloader?
10. Which tool provides API arguments, which provides Windows operations, and

which shows live modules/memory?