Intro to Malware Analysis

Prompts and answers

• Which team uses malware analysis to look for IOCs and hunt for malware in a network?
  Threat hunt team
• Which technique is used for analyzing malware without executing it?
  Static analysis
• Which technique is used for analyzing malware by executing it and observing its behavior in a controlled environment?
  Dynamic analysis
• In the attached VM, there is a sample named 'redline' in the Desktop/Samples directory. What is the md5sum of this sample?
  ca2dc5a3f94c4f19334cc8b68f256259
• What is the creation time of this sample?
  2020-08-01 02:44:18 UTC
• In the attached VM, there is a sample named 'redline' in the directory Desktop/Samples. What is the entropy of the .text section of this sample?
  6.453919
• The sample named 'redline' has five sections. .text, .rdata, .data and .rsrc are four of them. What is the name of the fifth section?
  .ndata
• From which dll file does the sample named 'redline' import the RegOpenKeyExW function?
  ADVAPI32.dll
• Check the hash of the sample 'redline' on Hybrid analysis and check out the hybrid analysis report. In the process tree, which is the first process launched when the sample is launched?
  setup_installer.exe
• In the process tree, there are two Windows utilities utilized by the malware to perform its activities. What are the names of the two utilities? (Format: utility1.exe and utility2.exe)
  cmd.exe and powershell.exe
• Which of the techniques discussed above is used to bypass static analysis?
  packing
• Which technique discussed above is used to time out a sandbox?
  long sleep calls