Source: Juni_2026_Exams/Advance_Forensics/reference_pdfs/README.md
Reference PDFs
Available Sources
| File | Pages | Purpose |
|---|---|---|
Exams2025_Malware_Analysis-2.pdf |
1 | 2025 practical exam questions |
Exams2025_Malware_Analysis_Answers.pdf |
6 | Submitted/model answer evidence |
Lecture 1 Malware Analysis - Hashes.pdf |
83 | Lab setup, file types, hashes |
Lecture 2-3 PE and memory.pdf |
117 | PE structure and process memory |
Lecture 4 Static Analysis.pdf |
87 | Static triage, packing, imports/resources |
Lecture 5-6 Dynamic Analysis.pdf |
101 | ProcMon, APIs, Regshot, integrated analysis |
Lecture 7.1 Malware Persistence.pdf |
64 | Startup, registry, services, tasks, hijacking |
Lecture 8 Malware Communications - Networking.pdf |
80 | DGA, FakeNet, HTTP/TLS, API context |
Lecture 9-10 Classic process injection techniques.pdf |
98 | DLL/code/shellcode injection |
Derived Documents
notes/00-focus-points.md: exam-grounded prioritiesnotes/01-tooling-overview.md: correct malware-analysis toolchainnotes/13-lecture-exercises-step-by-step.md: 47 guided lecture exercisessolutions/exam-2025-verified-walkthrough.md: exact exam task walkthroughchecklists/malware-analysis-exam-checklist.md: practical exam checklist
Collaboration Rules
- Do not rename or modify source PDFs.
- Add new source PDFs here with descriptive filenames.
- Record the source filename and PDF page for every extracted exercise.
- Put study notes in
notes/, solutions insolutions/, and quick references
in checklists/.
- Do not commit live malware samples, VM disks, credentials beyond those
printed in the exam paper, or student personal data.
- Do not claim an exercise result unless it was observed in the designated VM.
- Keep screenshots outside Git when they contain large binaries or personal
information; document their expected location in the relevant guide.
Last audited: June 15, 2026