IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Advance_Forensics/solutions/exam-2025-verified-walkthrough.md

2025 Malware Analysis Exam - Verified Walkthrough

Source

This walkthrough is based directly on:

The exam VM credentials shown in the paper are:

Username: ieuser
Password: <LAB_VM_PASSWORD_FROM_EXAM_PDF>
Sample: C:\Temp\sample.exe

Use only the university-provided VM. Restore a clean snapshot before practice.

Deliverable Requirements

Question 1: File Type and Packing

Marks: 2

Procedure

  1. Calculate and record the sample's SHA-256.
  2. Open sample.exe in CFF Explorer.
  3. Record the PE machine/characteristics and whether it is 32-bit or 64-bit.
  4. Open it in Detect It Easy.
  5. Capture the type/compiler/packer detection screen.
  6. Open the Entropy view.
  7. Record overall and section entropy.
  8. Cross-check with PEiD/PEview and section names/raw-versus-virtual sizes.

Verified 2025 answer

Correct reasoning

High entropy is strong supporting evidence for packing or encryption. The answer is stronger when combined with packer signatures, unusual section names, sparse imports, or raw/virtual-size anomalies.

Question 2: Files Created in C:\Temp

Marks: 2

Procedure

  1. Restore the VM snapshot.
  2. Start ProcMon.
  3. Stop capture with Ctrl+E and clear with Ctrl+X.
  4. Add Process Name is sample.exe as an include filter.
  5. Start capture and execute sample.exe as required by the exam.
  6. Stop capture after behavior completes.
  7. Save the unfiltered trace.
  8. Filter filesystem operations such as CreateFile, WriteFile,

SetRenameInformationFile, and SetDispositionInformationFile.

  1. Add Path begins with C:\Temp if needed.
  2. Record created artifacts, including files that are deleted quickly.

Verified 2025 answer

The answer PDF reports:

The answer notes that these artifacts were deleted almost immediately.

Screenshot

Show the Process Name, Operation, Path, Result, PID, and Time columns.

Question 3: Code Injection and Four API Stages

Marks: 4

Procedure

  1. Run APIMiner against the sample:

``text C:\Users\IEUser\Desktop\APIMiner.lnk --app C:\Temp\sample.exe ``

  1. Preserve every generated APIMiner trace.
  2. Search the traces by API family.
  3. Capture a screenshot for each stage with the API and useful parameters.
  4. Explain why the APIs form an injection chain.

Stage 1: Find/open a target

Verified APIs:

The lecture also identifies Process32First and Process32Next as common enumeration APIs.

Stage 2: Privilege and memory preparation

Verified APIs:

Depending on the technique, a trace may instead show VirtualAllocEx or NtAllocateVirtualMemory.

Stage 3: Map/write the payload

Verified APIs:

This is section mapping rather than the classic WriteProcessMemory-only pattern.

Stage 4: Execute through thread manipulation

Verified APIs:

Other lecture variants use CreateRemoteThread, NtCreateThreadEx, QueueUserAPC, or ResumeThread.

Conclusion

Conclude injection only after explaining the sequence and target context. A single API can be used legitimately; the cross-process sequence is the important evidence.

Question 4: Created Threads and IDs

Marks: 2

Procedure

  1. Return to the saved ProcMon trace.
  2. Filter with Operation contains Thread.
  3. Keep the sample process filter or inspect Process Tree.
  4. Record each distinct TID shown for relevant thread events.
  5. Capture the filtered list with the TID column visible.

Verified 2025 answer

The submitted answer reported four thread IDs:

3608
3424
1176
2684

These IDs are valid only for that execution. A new run will normally produce different IDs, so record the IDs from your own trace.

Scoring Strategy

The marks are evenly practical:

Task Marks Main tool
PE type and packing 2 CFF Explorer + DiE
Created files 2 ProcMon
Four injection stages 4 APIMiner
Thread IDs 2 ProcMon

Prioritize reliable captures and concise explanations. The injection question is worth 40 percent of the paper.