Basic Static Analysis

Walkthrough summary

Basic Static Analysis TryHackMe walkthrough with 9 answered prompts and lab methodology notes.

Sample prompts covered

• On the Desktop in the attached VM, there is a directory named 'mal' with malware samples 1 to 6. Use floss to identify obfuscated strings found in the samples named 2, 5, and 6. Which of these samples contains the string 'DbgView.exe'?
  Open the walkthrough page to inspect the full answer and command flow.
• In the samples located at Desktop\mal\ directory in the attached VM, which of the samples has the same imphash as file 3?
  Open the walkthrough page to inspect the full answer and command flow.
• Using the ssdeep utility, what is the percentage match of the above-mentioned files?
  Open the walkthrough page to inspect the full answer and command flow.
• How many matches for anti-VM execution techniques were identified in the sample?
  Open the walkthrough page to inspect the full answer and command flow.
• Does the sample have to capability to suspend or resume a thread? Answer with Y for yes and N for no.
  Open the walkthrough page to inspect the full answer and command flow.