Source: Juni_2026_Exams/Advance_Forensics/solutions/exam-2025-verified-walkthrough.md
2025 Malware Analysis Exam - Verified Walkthrough
Source
This walkthrough is based directly on:
reference_pdfs/Exams2025_Malware_Analysis-2.pdfreference_pdfs/Exams2025_Malware_Analysis_Answers.pdf
The exam VM credentials shown in the paper are:
Username: ieuser
Password: <LAB_VM_PASSWORD_FROM_EXAM_PDF>
Sample: C:\Temp\sample.exe
Use only the university-provided VM. Restore a clean snapshot before practice.
Deliverable Requirements
- Create a PDF named
Exams2025_<your-name>.pdf. - Provide a screenshot for every answer.
- Screenshots must show the tool or command and the relevant result.
Question 1: File Type and Packing
Marks: 2
Procedure
- Calculate and record the sample's SHA-256.
- Open
sample.exein CFF Explorer. - Record the PE machine/characteristics and whether it is 32-bit or 64-bit.
- Open it in Detect It Easy.
- Capture the type/compiler/packer detection screen.
- Open the Entropy view.
- Record overall and section entropy.
- Cross-check with PEiD/PEview and section names/raw-versus-virtual sizes.
Verified 2025 answer
- File type: Portable Executable 32-bit.
- Packing assessment: packed.
- Reported entropy:
7.99488, approximately the maximum value of 8.
Correct reasoning
High entropy is strong supporting evidence for packing or encryption. The answer is stronger when combined with packer signatures, unusual section names, sparse imports, or raw/virtual-size anomalies.
Question 2: Files Created in C:\Temp
Marks: 2
Procedure
- Restore the VM snapshot.
- Start ProcMon.
- Stop capture with
Ctrl+Eand clear withCtrl+X. - Add
Process Name is sample.exeas an include filter. - Start capture and execute
sample.exeas required by the exam. - Stop capture after behavior completes.
- Save the unfiltered trace.
- Filter filesystem operations such as
CreateFile,WriteFile,
SetRenameInformationFile, and SetDispositionInformationFile.
- Add
Path begins with C:\Tempif needed. - Record created artifacts, including files that are deleted quickly.
Verified 2025 answer
The answer PDF reports:
old_sample.exe- directory
ui ui\SwDRM.dllui\IPHLPAPI.DLLui\WINNSI.DLLui\powrprof.dllui\config.json
The answer notes that these artifacts were deleted almost immediately.
Screenshot
Show the Process Name, Operation, Path, Result, PID, and Time columns.
Question 3: Code Injection and Four API Stages
Marks: 4
Procedure
- Run APIMiner against the sample:
``text C:\Users\IEUser\Desktop\APIMiner.lnk --app C:\Temp\sample.exe ``
- Preserve every generated APIMiner trace.
- Search the traces by API family.
- Capture a screenshot for each stage with the API and useful parameters.
- Explain why the APIs form an injection chain.
Stage 1: Find/open a target
Verified APIs:
CreateToolhelp32SnapshotOpenProcess
The lecture also identifies Process32First and Process32Next as common enumeration APIs.
Stage 2: Privilege and memory preparation
Verified APIs:
LookupPrivilegeValueWAdjustTokenPrivilegesVirtualAllocVirtualProtect
Depending on the technique, a trace may instead show VirtualAllocEx or NtAllocateVirtualMemory.
Stage 3: Map/write the payload
Verified APIs:
NtCreateSectionNtMapViewOfSectionNtUnmapViewOfSection
This is section mapping rather than the classic WriteProcessMemory-only pattern.
Stage 4: Execute through thread manipulation
Verified APIs:
CreateThreadGetThreadContextSetThreadContext
Other lecture variants use CreateRemoteThread, NtCreateThreadEx, QueueUserAPC, or ResumeThread.
Conclusion
Conclude injection only after explaining the sequence and target context. A single API can be used legitimately; the cross-process sequence is the important evidence.
Question 4: Created Threads and IDs
Marks: 2
Procedure
- Return to the saved ProcMon trace.
- Filter with
Operation contains Thread. - Keep the sample process filter or inspect Process Tree.
- Record each distinct TID shown for relevant thread events.
- Capture the filtered list with the TID column visible.
Verified 2025 answer
The submitted answer reported four thread IDs:
3608
3424
1176
2684
These IDs are valid only for that execution. A new run will normally produce different IDs, so record the IDs from your own trace.
Scoring Strategy
The marks are evenly practical:
| Task | Marks | Main tool |
|---|---|---|
| PE type and packing | 2 | CFF Explorer + DiE |
| Created files | 2 | ProcMon |
| Four injection stages | 4 | APIMiner |
| Thread IDs | 2 | ProcMon |
Prioritize reliable captures and concise explanations. The injection question is worth 40 percent of the paper.