Malware Analysis Practical

Question 1

How to trick malware so it perceives the sandbox as a regular user computer?

Answer 1

• make the VM look as real as possible
• install common end-user software
• open multiple files and documents
• don’t install VM guest tools
• trick the malware into thinking it is online
  
  • malware typically tries to do a DNS resolution of common websites

Question 2

How should be the malware analysis VM set up?

Answer 2

host-only networking mode and segmented from the internet

Question 3

What steps should you go through when creating a VM for malware analysis?

Answer 3

• install OS and patches
• install and run the analysis tools
• set up a host-only networking
• do additional maintenance tasks to make the system ready
• create a snapshot

Question 4

What questions should you answer during a static analysis?

Answer 4

• What kind of file is it?
• Is any information already known about it?
• What do the embedded strings tell about it?
• Is there anything unusual in the PE header?
• Is it packed? If so, what packer?

Question 5

Which three tools are used for file type identification?

Answer 5

1. file
2. Exeinfo PE
3. TrID

Question 6

What does TrID analyze in order to determine the actual file format?

Answer 6

the actual data within the file to determine its format

Question 7

How is TrID useful in malware analysis?

Answer 7

analyze unknown or suspicious files

Question 8

On which platform is TrID primarily used?

Answer 8

Windows

Question 9

How to use TrID?

Answer 9

Question 10

How are cryptographic hashes used in malware analysis?

Answer 10

• organize and indentify specific samples instead of using names
• find additional information online

Question 11

What is the name of a an app that can calculate several different cryptographic hashes for a file?

Answer 11

Compute Hash

Question 12

What is the tool from Microsoft used to analyze strings?

Answer 12

Strings

Question 13

Does Strings extract both ASCII and Unicode strings at the same time?

Answer 13

yes

Question 14

What is the minimum strings length by default in Strings?

Answer 14

3