Malware:ITX8060:2012

LABS/Homework

Windows images for first lab : Windows images and other files in future

Lab3

4 executables that youre tested in Malware 1 are they packed / encrypted ?

What makes you say so ? (how you determined)

What kind of packing was used (if could be tetermined) ideas how to unpack them ?

if no packing/encryption was used research one of thees packing metodologyes :

   1) FSG: Simple packer for Win32. Compression: aplib (LZ-based)
   2) MEW: Simple packer for Win32 (aplib) 
   3) NSPACK: Simple packer for Win32 (LZMA) 
   4) UPACK: Simple packer for Win32 (aplib)

choose according to student number

        if last  digits are  1 and 2  take 1 
        if  last digits  are 3 and 4  take 2
        if last  digits are  5,6,7    take 3
        if last digits are   8,9,0    take 4

Lab2

Revers enginer mirc

a bit more exact explanation on what you sould do.

Lab1

Find malware

describe your findings acording : http://computer-forensics.sans.org/blog/2012/05/08/writing-malware-reports

Considerng following:

does malware access internet - where 

How many diferent malware breads were in computer 

which files are interesting and sould considered target to deeper analysis

whatewer els you could find about infections

how to disinfect 

Deadline 21.11.2012

Be aware - downloading images takes time !

LECTURES

Moust of things are in google dock