Source: Juni_2026_Exams/Advance_Forensics/README.md

Advanced Forensics and Malware Analysis - June 2026

Purpose

This project is a practical study guide built from the uploaded 2026 lecture PDFs and the verified 2025 malware-analysis exam. The central skills are static PE analysis, dynamic monitoring, API tracing, persistence, networking, and process injection.

Start Here

The older disk-forensics notes remain useful supplemental material, but they do not represent the primary emphasis of the uploaded lectures or 2025 exam.

Verified 2025 Exam Pattern

The exam used C:\Temp\sample.exe inside a supplied VirtualBox VM:

Task	Marks	Main tools
Identify PE type and packing	2	CFF Explorer, DiE, PEiD
Identify files created during execution	2	ProcMon
Prove four code-injection stages through APIs	4	APIMiner
Identify created thread IDs	2	ProcMon

Every answer required screenshots showing the tool/command and result.

Source Material

The reference_pdfs/ folder contains:

2025 exam questions and answers
Lecture 1: setup, file types, hashes
Lectures 2-3: PE structure and memory
Lecture 4: static analysis
Lectures 5-6: dynamic analysis
Lecture 7.1: persistence
Lecture 8: malware communications/networking
Lectures 9-10: process injection

See reference_pdfs/README.md for the inventory and collaboration rules.

Repository Map

Advance_Forensics/
├── reference_pdfs/     # Unmodified source lectures and exams
├── notes/
│   ├── 00-focus-points.md
│   ├── 01-tooling-overview.md
│   ├── 13-lecture-exercises-step-by-step.md
│   ├── 14-exam-day-open-notes-reference.md
│   ├── 16-exam-terms-and-tools-glossary.md
│   └── ... supplemental forensic notes
├── solutions/
│   ├── exam-2025-verified-walkthrough.md
│   └── exam-answer-template.md
├── checklists/
│   └── malware-analysis-exam-checklist.md
├── exams/              # Additional/year-specific material
├── lectures/           # Optional material not in reference_pdfs
├── stories/            # Project status and open work
└── HANDOUT.md          # Collaboration guide

Study Plans

Two-Hour Review

Read focus points: 15 minutes.
Rehearse CFF Explorer/DiE packing analysis: 25 minutes.
Rehearse ProcMon capture and filters: 30 minutes.
Review the four injection stages/API families: 30 minutes.
Review the 2025 walkthrough and checklist: 20 minutes.

Seven-Day Practical Plan

Day	Focus
1	VM safety, hashes, file identification
2	PE headers, sections, imports, resources
3	Packing, entropy, strings, unpacking
4	ProcMon, Process Hacker, Regshot
5	APIMiner and process-injection exercises
6	Persistence, FakeNet, Wireshark
7	Timed reconstruction of the 2025 exam

Safety

Execute samples only in the designated isolated VM.
Restore a clean snapshot before each exercise.
Disable shared folders, clipboard, drag-and-drop, and USB.
Use FakeNet/internal networking instead of unrestricted Internet access.
Do not commit malware binaries, VM disks, or sensitive screenshots.

Current Status

Source PDFs inventoried and extracted.
Forty-seven lecture exercises documented.
2025 exam walkthrough completed from the actual question/answer PDFs.
Hands-on observations and screenshots still need to be produced in the

university VM.

Last updated: June 15, 2026