Forensics Investigation

3.1 Analyzing Hard Drive Forensic Images, Analyzing RAM Forensic

Image, Investigating Routers
3.2 Malware Analysis - Malware, Viruses, Worms, Essential skills and
tools for Malware Analysis, List of Malware Analysis Tools and
Techniques
3.1 Analyzing Hard Drive Forensic Images, Analyzing RAM Forensic
Image, Investigating Routers

3.1.1 Analyzing Hard Drive Forensic Images

The hard drive is the premier form of data storage used in a computer system: the
majority of computer users’ and corporations’ data is stored on it. When a hard drive
becomes a part of a legal investigation, it should be legally acquired.
It is the role of the forensic examiner to investigate this data and connect the dots to
solve a crime or to understand what happened during an incident.
In this Topic, we will learn how to mount and analyze acquired hard drive forensics
images using different tools, focusing on the open source and free tools.
1. Arsenal Image Mounter
● Arsenal Image Mounter is a free, open source program. It can mount a forensic image
as complete disks in Windows (real SCSI disks), allowing investigators to browse
image contents as if they were browsing any directory of files. While the free version
can mount any forensic image, the paid one supports more rich features.
● This tool supports forensic images in Raw and EnCase file format, and it also supports
all file systems used by the Windows OS like NTFS and FAT32.
● Using this tool is very simple: go to [Link] and download the
program to your PC. Arsenal Image Mounter is a portable program, so just execute the
program and then click the “Mount Image” button in the main program window to
select the image file; now, the tool will ask you for mount options. Check the first
option, “Read only,” and then press the “OK” button.
● Image mount options: use “Read only” to avoid writing data to suspect image.
● Now, the forensic image will get mounted as a virtual drive in Windows (you can
access it from Windows file explorer) as if it were a local drive.
2. OSFMount
This is another program for mounting the forensic drive image as local Windows
drives; OSFMount supports mounting images of CDs in .ISO format. It also
supports the creation of RAM disks (a disk mounted into RAM). Supported image
file formats include, among others, AFF, Raw, split Raw, and EnCase.
To use this program, follow these steps:
1. Go to [Link]/tools/[Link] and download the
tool that corresponds to your current Windows version (32 or 64 bits).
2. Install the program as you do with any Windows program.
3. When the program successfully launches, click the “Mount new” button; a new
dialog will then appear where you can select the image file and set other mount
options (see Figure 6-3). OSFMount will mount the image by default as read only
and you can access it from Windows File Explorer like any other local drive.
Figure 6-3. OSFMount “Mount
drive” options
Autopsy
Autopsy is a graphical user interface (GUI) program that allows easy access to the
command-line tools and the C library included in the Sleuth Kit and other digital
forensics tools. The tools included in the Sleuth Kit—and other digital forensics
tools— will allow Autopsy to automate much of the forensics analysis tasks required
in most investigations, such as recovering deleted files, analyzing Windows registry,
investigating e-mail messages, investigating unallocated disk space, and many more.
Autopsy provides additional features that help examiners to be more productive during
their analysis work.
Autopsy is a robust forensic platform used by thousands of users around the world; it
has active support from a volunteer community in addition to commercial support for
paid users. Autopsy features can be extended with customized modules (Autopsy
names them “ingest modules”) that can be developed using Python (Jython) or Java
programming language.
Autopsy supports the following data source types:
1. Disk image (the most used option)—an acquired disk or hard drive image.
2. Logical disk—Like local hard drive and storage attached to the current system like
USB thumb drive.
3. Logical files—Like single files or folders.
4. Unallocated space image file—Autopsy will search within the unallocated space of
an image file for deleted files.
Autopsy is an automated forensic program; hence, when adding a forensic image to it,
Autopsy will automatically extract the most common information used in digital
forensic analysis from this image without needing to do this manually. Autopsy
provides default ingest modules for analyzing a provided data source (e.g., forensic
image);
To recover deleted files from the supplied data source (e.g., forensic image), go to the
Data Explorer pane on the left. Select Views ➤ Deleted Files. To recover a file(s),
right-click over it, select Export File(s), and select a destination where you want to
save it
3.1.2 Analyzing RAM Forensic Image
To analyze RAM forensic images, we have two reputable and popular free
tools: Redline from FireEye and Volatility from the Volatility Foundation.
Redline
FireEye give the forensics community two popular free forensic tools to
conduct digital forensics investigations:
1. Memoryze: This is a physical memory imaging and analysis command-line
tool. In addition to capturing RAM images, it has the ability to perform
advanced analysis of live memory while the computer is still running.
Memoryze can also analyze memory image files, whether they were acquired
using it or any other forensic software (DD-format). However, the analysis will
give more comprehensive results when the forensic image is acquired by the
Memoryze tool itself.
2. Redline: This is a Windows program for conducting a memory investigation of
malicious artifacts in Windows physical memory. With Redline, you can:
• Capture memory images, running processes, opened files, and registry data.
• Filter (narrow) results according to many predefined criteria (such as a given
timeframe of compromise events [when it started, which files were touched, and how
long the compromise persisted]) and/or filter known valid data based on precompiled
MD5 hash values of well-known files.
Capturing a RAM Memory Using Redline
Before we can use Redline to capture memory, we need to download it first.
1. Go to [Link]/services/freeware/[Link]; you need to fill in a simple
registration form and the download link will send to the specified e-mail address.
2. Install the program on your Windows machine as you do with any other Windows
application. Redline is supported on almost all versions of Windows: Windows XP,
Windows Vista, Windows 7, Windows 8 (32 and 64 bit), Windows 10.
3. Launch the program, and the main window will appear . From the “Collect Data”
pane, select “Create a Comprehensive Collector.”
Before we move on, let us give a brief description of available options when using
Redline to collect (capture) data from a suspect Windows computer.
Redline has three types of collectors:
• Standard Collector: This type gathers the minimum amount of data (mainly process
and loaded driver information).
• Comprehensive Collector: This type collects most of the data that Redline needs
during its analysis process. This type of collection is very recommended and this what
we are going to use during this experiment.
• IOC Search Collector: This type collects only the data that matches selected
Indicators of Compromise (IOCs).
4. In our case, we will select “Comprehensive Collector”; click it, and the collector
configuration window appears. From this window, you can configure what you are
going to capture by clicking “Edit your script”; you should also check the option
“Acquire Memory Image” to acquire the target memory image (see Figure 6-20).
Figure 6-20. Configure
Standard and
Comprehensive Collector
in Redline;
please note that both
collectors share the same
window but with different
default
configurations
5. The Redline Collector script (you can access it from “Edit Your Script”) has memory, disk,
system, network, and other options preselected. You can modify these options within any
collector type. For instance, the comprehensive collector type (which we have chosen to select for
this example) has most options already checked by default, so you can go safely with the default
settings (see Figure 6-21).
Figure 6-21. View/edit
collector settings in Redline
6. Now, from the collector configuration window, click “Browse” under “Save Your
Collector To” and select an empty directory where you want to save this collector. For
instance, we will store it on a USB thumb drive, so that we can use it later to acquire a
memory image from suspect machine. Click “OK” to begin writing to the Redline
collector (see Figure 6-22).
7. When Redline finishes creating the collector, a success window will pop up,
showing you important information on how to use this collector to acquire memory
data from potentially compromised systems (see Figure 6-23).

Figure 6-23. Redline showing collector

instructions after creating it
Now that we have created our collector, let us see how we can use it to acquire memory images:
1. Go to the directory where you have saved your newly created collector, and move the entire
collector folder into a USB thumb drive.
2. Attach the USB thumb drive into the target machine.
3. Execute the script named “[Link]” in the collector folder to run the collector
(see Figure 6-24).
Figure 6-24. Running the collector to
begin acquiring RAM memory of the
target machine
4. The collector should begin its collection work by showing a CMD window (see Figure 6-25),
and it will store acquired data to a folder named ‘Sessions\AnalysisSession1’ in the same
directory. Every time you run the script, a new AnalysisSession folder (AnalysisSession2,
AnalysisSession3, etc.) is created.
5. After the Collector completes the collection, the CMD window should disappear without
showing any message. Now, go into the AnalysisSession folder, and you will see an Audits
folder and an [Link] file (see Figure 6-26).

Figure 6-26. Collector data (XML files) are stored within the Audits folder

Now that we have acquired suspect machine volatility data (in addition to other important data
like Prefetch folder information), it’s time to begin the analysis process using Redline.
Memory Forensics Using Redline
To analyze memory data collected by the Redline collector, follow these steps:
1. Move the Sessions folder from the Collector folder into the forensic machine that you want to
perform the analysis on. Of course, Redline should be installed on this machine first.
2. Open Sessions ➤ AnalysisSession1 (there could be more than one analysis session if you run
the collector more than once) and you will see an Audits folder and an [Link]
file.
3. Double-click the ‘[Link]’ file to create your session in Redline. This
automatically imports the data into Redline (see Figure 6-27).

Figure 6-27. Create new analysis session in Redline to investigate acquired image data
4. Importing data into Redline will take some time (from minutes to hours); the time
needed will depend on the size of the captured memory image and the acquired
memory operating system type.
5. Once the data has finished loading into the new analysis session, the Redline
analysis session window will appear. Redline groups data by type; you will see these
groups on the left side of the Analysis Data frame.
6. You have different options to start your investigations; for instance, we will use the
option “I am Investigating a Host Based on an External Investigative Lead.”
7. A new window will appear click any data type in the “Analysis Data” (corresponds
to number 1) pane to see all related acquired information on the right pane. The middle
pane allows you to set some filters (corresponds to number 2) on the data to limit the
number of returning data, while the third pane displays the sum of filtered information
according to what a user has selected in pane 2.
Volatility Framework
Volatility is another famous tool for analyzing RAM forensic images; it is a
research project that has emerged from published academic research papers in the
field of advanced memory analysis and forensics.
It is a free, open source, and cross-platform program written in python; its
development is now supported by a nonprofit organization known as the Volatility
Foundation.
Volatility comes already installed with many Linux security distributions like
Kali; however, this tool is also supported on Windows machines (a standalone
portable application). The latest version is 2.6, and you can download it from
www. [Link]/26.
3.1.3 Investigating Routers
Routers play many different roles during incidents. They can be targets of attack,
stepping-stones for attackers, or tools for use by investigators. They can provide valuable
information and evidence that allow investigators to resolve complex network incidents.

[Link] OBTAINING VOLATILE DATA PRIOR TO POWERING DOWN

The order of volatility states that information in memory is most volatile, while information
stored on the hard drive or in nonvolatile RAM (NVRAM) is relatively stable.
Accordingly, if any of the information in memory may be important to the investigation, it
must be saved before powering down or altering the state of the operational router.
With routers, information in memory is almost always important, because routers have little
data-storage capability. The only real data saved in NVRAM is the configuration of the
router itself, and this configuration is likely not the same configuration the router uses
while it is running, especially if the router has been the subject of hacker attack.
The system state information in memory—such as current routing tables, listening services,
and current passwords—will be lost if the router is powered down or rebooted.
Steps in Investigating Routers:
● Sometime routers that have been compromised or involved in attacks.
● The information from these investigative steps will allow you to determine if the router
is compromised or not, by just looking into the configuration which is not as expected.
● The information on the router configuration will also provide a clear picture of how
packets are routed within the network.
● Depending on the details of a specific incident whether you suspect the router has been
an active part of an attack or merely a stepping-stone or you may choose to omit or
change the order of some of the actions discussed here.
1. Establishing a Router Connection
● The best way to access the router is from the console port. By connecting directly to the
router, you are less likely to tipoff any attacker who still has access to the network.
● If you telnet to the router, an attacker with a network sniffer can potentially see your traffic
and learn that an investigation is being conducted.
● If console access is unavailable, a dial up connection or an encrypted protocol such as
Secure Shell (SSH) is a better choice than telnet.
● When establishing a connection to the router, make sure to log the entire session.
2. Recording System Time
One of your first steps should be to record the system time. The time will be critical when
cross-referencing other data later, and individual systems often have different time settings. Use
the show clock command to get the system time (enable, or privileged, level access is not
required). cisco_router>show clock *03:13:21.511 UTC Tue Mar 2 2003\
3. Determining Who Is Logged On
Next, determine if anyone else is logged on to the router. Use either the show users or
systat command to produce results such as these:
cisco_router>show users Line User Host(s) Idle Location
* 0 con 0 idle 00:29:46
1 vty 0 idle 00:00:00 [Link]
2 vty 1 [Link] 00:00:36 [Link]
This output shows that three users are currently logged on to the router:
● The first entry shows that someone is logged in at the console (con). The asterisk
(*) on the far left indicates that this is our connection—the one from which we
logged on.
● The second entry is a vty, or virtual terminal line. It indicates that someone has
logged on to the router from the host with IP address [Link].
● The final virtual terminal connection shows that someone has logged on from IP
address [Link], and that same person has established a connection from the
router to the host with IP address [Link].
As you can see, this is useful information when investigating incidents. As with
any investigation, if you find someone else logged on to the victim system, you
should reevaluate how to proceed.
4. Determining the Router’s Uptime
The time that the system has been online since the last reboot can also be important.
Use the show version command to capture this information.
cisco_router>show version
A significant amount of information is available from this command. The software and hardware
information will provide you with a clear picture of the capabilities of the router in question.
5. Determining Listening Sockets
Routers have limited functionality when compared to a lot of technologies, making it
exponentially more difficult for attackers to introduce trojan code that creates backdoors.
However, routers do provide a number of services that allow remote connections. Telnet is the
most well known, but there are others. One way to discover if there are any access paths into a
router that you don’t know about is to determine which ports (sockets) are listening on the router.
To determine which services are running on the router, use an external port scanner or examine
the configuration file. The configuration file covers all aspects of the router’s configuration, and
we will discuss saving that file in the next section.
An example of checking for all TCP and UDP listening ports with the port scanner ScanLine
follows: C:\ScanLine>sl -p -t 1-65535 -u 1-65535 [Link]
6. Saving the Router Configuration
● All configuration information for Cisco routers is stored in a single configuration file.
This configuration rules all aspects of the router’s behavior, and it is stored in
NVRAM. The router uses this stored configuration when it boots.
● However, you can change the configuration of the router without modifying the
configuration file stored in [Link], the changes to the configuration are
made in RAM, and they are saved to NVRAM only by an administrative command.
● Thus, you should save the configuration that is in RAM as well as the configuration in
NVRAM.
● To save the configuration files, you must have enable (privileged) level access to the
router. Use the show running-config command or the equivalent (but older) write
terminal command to view the configuration currently loaded on the router.
7. Reviewing the Routing Table
● The routing table contains the blueprint of how the router forwards packets. If an
attacker can manipulate the routing table, the attacker can change where packets
are sent. Understandably, manipulating the routing table is a primary reason for
compromising a router.
● The routing table can be manipulated through command-line access, as well as
through malicious router update packets. In either case, the routing table will
reflect the changes.
● To view the routing table, use the show ip route command.
8. Checking Interface Configurations
Information about the configuration of each of the router’s interfaces is available via
the show ip interface command. While this information is also available within the
configuration file, this command is useful because it gives a lot of information in an
easy-to-read format.
9. Viewing the ARP Cache
Address Resolution Protocol (ARP) maps IP addresses and media access control
(MAC) addresses. Unlike IP addresses (which are Network layer
addresses),MACaddresses are physical addresses (layer 2 of the OSI model) and are not
routed outside broadcast domains.
Routers store the MAC addresses of any device on the local broadcast domain, along
with its IP address, in the ARP cache. Packets originating on remote networks display
the MAC address of the last router traversed.
Attackers occasionally spoof IP or MAC addresses to circumvent security controls,
such as access control lists (ACLs), firewall rules, or switch port assignments.
Accordingly, the ARP cache can be useful when investigating attacks of these types.
And since it is easy to destroy and easy to save, you might as well save the information.
Use the show ip arp command to view the ARP cache
[Link] FINDING THE PROOF
This is the next step after saving the required information or evidence from routers depends
on the type of incident suspected, based on your initial investigation. We categorize the
types of incidents that involve routers as follows:
1. Direct compromise
2. Routing table manipulation
3. Theft of information
4. Denial of service
1. Handling Direct-Compromise Incidents
An attacker gains interactive or privileged access to the router it is called an Direct
compromise of the router. Direct compromise provides the attacker with control of the
router and access to the data stored on the router.
1.1 Investigating a Direct-Compromise Incident
i) Listening Services The listening services on the router provide the potential attack points
from the network. The list of interfaces should tell you if the router has modem access. A
review of the physical security of the router will determine the relative accessibility of the
console port.
ii) Passwords Routers can have different passwords for different services, such as telnet, SNMP,
and enable access. Attackers can learn the passwords to the router through a variety of different
means. The most obvious is through brute force password guessing. Most brute force password
guessing attacks are picked up by the IDS, which is helpful during investigations.
If the passwords in use are extremely difficult to guess (alphanumeric, more than eight characters,
and so on), then brute force password guessing probably was not the means of compromise. The
passwords are stored in the configuration file, either as cleartext or encrypted using the Vigenere
cipher (XOR) or MD5 algorithm. Another way for attackers to learn the password is through
network sniffing. Any protocol that passes cleartext data and authentication information—such as
SNMP, telnet, HTTP, and TFTP—is vulnerable to network sniffing.
iii) Other Compromise Possibilities: Routers use TFTP to store and reload configuration files over a
network. TFTP is a UDP protocol, inherently insecure. It requires no authentication, and all data passes as
cleartext. Router configuration files often use the naming convention of <hostname>-confg or
<hostname>.cfg. To take advantage of these factors, an attacker only needs to scan a network for a router and
a TFTP server. The attacker learns the hostname of the router via Domain Name System (DNS) resolution and
requests the configuration file from the TFTP server. At this point, the attacker can use the password
information in the configuration file to access the router or modify the configuration file, and then upload to
the TFTP server and wait for a network reload. Cisco IOS version 12.0 and later supports other methods,
such as FTP, for storing and reloading configuration files.
1.2 Recovering from Direct-Compromise Incidents
After a direct-compromise incident, all recovery steps should be taken while the router is offline.
The recovery should be commensurate with the attack, but as always, a paranoid stance is
preferred. When in doubt, take the extra steps for security. Examples of steps that should be taken
include the following:
● Remove all unnecessary services.
● Allow remote access only through encrypted protocols.
● Allow no SNMP access or read-only access.
● Do not use the SNMP password as the password for any other access.
● Change all passwords.
● Implement ACLs so that only connections from trusted hosts are allowed to the router.
● Upgrade the software with the latest updates.
2. Handling Routing Table Manipulation Incidents
Routers can use a variety of protocols to update their routing tables, including RIP, Open Shortest
Path First (OSPF), Enhanced Interior Gateway Routing Protocol (EIGRP), Interior Gateway
Routing Protocol (IGRP), Border Gateway Protocol (BGP), and so on.
These protocols communicate information about the best path between networks to neighbor
routers, and they have varying degrees of security.
Some, like the ubiquitous RIP, provide no authentication capability. A router will accept RIP
updates without requiring any authentication. Other protocols offer the capability of requiring
passwords, but it is up to the administrator to implement password security. Attacks involving
routing table manipulation compromise the functionality of the router, rather than the router itself.
2.1 Investigating Routing Table Manipulation Incidents
Determining the current routing table is as simple as reviewing the output of the show ip route
command. If any of the routes do not pass the common sense test, or if packets appear to be
routed through distant networks, then careful investigation is required. If unfamiliar static routes
appear in the routing table, then the router may have suffered direct compromise.
2.2 Recovering from Routing Table Manipulation Incidents
● Temporary recovery from routing table attacks is simple: Remove unwanted static routes
and reboot the router.
● However, preventing the attacks from occurring in the future is a bit more difficult. ACLs
can be introduced to limit router updates to known-good source addresses.
● However, because some routing protocols are UDP, these addresses can be spoofed.
Anti-spoofing ACLs can further limit exposure, but these lists are not foolproof.
● The routing protocol chosen should allow for authentication, and the authentication should
be enabled.
3. Handling Theft of Information Incidents
Stealing data from routers is difficult, since little data exists on the router. An attacker will not
find the payroll database or any secret formulas on a router.
The information that is on the router is related to network topology and access control.
Typical information that attackers glean from routers includes password, routing, and topology
information. The recovery from this data theft is to change passwords, avoid password reuse, and
limit the ability of attackers to obtain sensitive information.
4. Handling Denial-of-Service (DoS) Attacks
DoS attacks are often directed at routers. If an attacker can force a router to stop forwarding
packets, then all hosts behind the router are effectively disabled. DoS attacks fall into several
basic categories:
Destruction Attacks that destroy the ability of the router to function, such as deleting the
configuration information or unplugging the power.
Resource consumption Attacks that degrade the ability of the router to function, such as by
opening many connections to the router simultaneously.
Bandwidth consumption Attacks that attempt to overwhelm the bandwidth capacity of the
router’s network.
4.1 Investigating DoS Attacks
If the router is not working at all, it is probably a destruction attack. Check the obvious problems
first: power, cables, and configuration.
A flood of packets directed to the router can also cause degradation. If the router has open ports,
then an overabundance of SYN or similar packets may adversely impact the performance of the
router. Alternatively, even if the router has no open ports, a flood of traffic may impact the router
or use the bandwidth such that network performance is significantly degraded. A DDoS attack is
an example of a bandwidth attack.
4.2 Recovering from DoS Attacks
Recovery usually consists of a combination of the following measures:
● Eliminate listening services.
● Upgrade software to the latest version.
● Restrict access to listening services using ACLs.
● Implement ACLs to limit malicious traffic.
3.2 Malware Analysis - Malware, Viruses, Worms, Essential skills and
tools for Malware Analysis, List of Malware Analysis Tools and
Techniques
Malware, Viruses, Worms
● Malware is a software that is programmed to perform malicious work against a victim’s system.
● It is an executable code that performs work without user’s permission or consent either on a local
system or over a network.
● For example, malware can steal sensitive data from users, organizations or companies. Therefore,
malware can be seen as a virus or worm or even a backdoor.
● A virus is malicious code that needs a host file or a running process, usually an executable piece
of code on a single computer for inserting malicious code, propagation, duplication, concealment
● and running the virus in the background.
● On the other hand, a worm is similar to a virus in terms of aforementioned features, except that it
does not necessarily need a host file and can run over a network.
● In order to analyse malware, it is important to know the first step that how malware exploits to
get on a computer.

How Does Malware Get on Computers

● Installing or using a cracked version of software
● remote buffer overruns are exploited by attackers to execute malicious software or to download
other applications on compromised systems.
Importance of Malware Analysis
● The malware are mainly designed to harvest user credentials or stealing sensitive
information or damaging the system’s performance. Malware is a very complicated issue
since it continues to evolve.
● For example, Ransomware is one trend example in the evolution of malware where malware
encrypts the victims’s data and holds them hostage for ransom in order for the victims to
have their files to be decrypted.
● we need to better educate people not to fall into the malware trap, to understand how
malware affects a vulnerable computing system and what exactly malware does.
● To prevent malware from affecting the system, better approaches could be developed to
build more effective defenses against malware. Also, it could lead to a solution to restoring
data and services from malware infection.
● It can be achieved through the analysis of malware. Malware analysis is the process of
determining the purpose and functions of a given malware sample such as a virus, worm, or
backdoor.
● malware analysis has become a critical aspect of today’s forensic investigations as
increasingly, malware are found on the compromised systems.
Essential Skills and Tools for Malware Analysis
From a security’s point of view, malware analysis and skills required include:
• Understanding some topics in programming languages (i.e., C/C++) such as functions,
pointers, arrays, stack, and heap. Especially, it is very important to understand how
function’s arguments are passed.
• Wide knowledge about assembly language in terms of aforementioned topics and machine
language.
• Understanding PE and COFF files and their structures.
• What EXE, DLL, OCX, etc. are, how they work and their differences.
• Exported and imported tables and functions in EXE and DLL files.
• Cryptographic techniques.
• What some vulnerability is and how it can be exploited either remotely or locally.
• What shellcode and shellcode analysis are.
• Tools used for static and dynamic analysis, including debuggers, de-compilers,
disassemblers, packing and unpacking techniques and process and file and registry
monitors.
List of Malware Analysis Tools and Techniques
● This section explains some key terms used in a wide variety of tools. First, an
executable file on Windows systems comes with an .EXE or .DLL extension.
● It contains executable code while an application or program resides in an EXE file.
● Dynamic link libraries come with a .DLL extension and are loaded by the Windows
operating system loader. It can also be loaded by another application.
● Microsoft uses the term portable executable (PE) to refer a file format used by
Windows. The PE contains headers and sections. These sections contain useful
information used by an executable such as the executable instruction in the .CODE or
.TEXT section.
● Finally, there are two techniques used in malware analysis, namely, static and
dynamic. Static analysis is the process of analysing an executable file or its
functionality without running it, particularly first using a decompiler to decompile the
executable file back to its source code .
● Dynamic analysis, on the other hand, involves running the executable.
Both analyses give different information about an application being analysed and use
different tools.
1. Dependency Walker
● It is a most popular Malware Analysis tool.
● This tool determines what functions are imported and exported in an executable file.
● An executable file comes with an .EXE or .DLL extension. It contains executable code
while an application or program resides in an EXE file.
● Those functions play a vital role in understanding how and what a malicious program does.
● It is also important to know that those functions have some legitimate uses in Windows
programming.
● If you conduct a malware analysis and see them, then they are probably used for malicious
functionality as well.
2. PEview
Microsoft uses Portable Executable (PE) files to refer executables. The PE file format can be
seen as a data structure that contains information about executables (i.e., images in Microsoft
jargon) used by the Windows loader.
i. Each PE file or image usually contains two headers. The first part of the PE header is related
to MS-DOS applications. There are sections for this part (the IMAGE_DOS_HEADER and
MS-DOS Stub) that are not interesting to us, except two fields in the IMAGE_DOS_HEADER
(i.e., e_magic and e_lfanew).
ii. The second part of the PE file followed the IMAGE_DOS_HEADER and MS-DOS Stub is
the IMAGE_NT_HEADER. The IMAGE_NT_HEADER is a structure that contains three
elements, namely, Signature, File Header and Optional Header.
3. W32dasm
This software helps in extracting more information about executable files especially EXEs and
DLLs.
W32Dasm can provide detailed information regarding the imported and exported functions and
modules (DLLs) used by [Link]. Figure
4. OllyDbg
Ollydbg is a debugger used for reverse engineering of programs. It is widely used by crackers to
crack software written for Windows. This tool helps us in tracing registers, stack, heap and
recognizing procedures, API calls and loops. In addition, it can directly load and debug DLLs.
5. Wireshark
● Wireshark is considered one important network protocol analyzers. It helps you to monitor
your network and see what is happening on sent or received packets of different protocols
and applications in real time.
● More importantly, it gives you an opportunity to capture network traffic and save captured
data for later analysis.
● We take advantage of this feature if we want to statically analyze captured packets from a
virtual machine to a physical one.
● Files captured have the extension .pcap or .cap

6. ConvertShellCode
we define shellcode to be assembly code written in hex that allows the following tasks:
● A local or remote user to control the compromised system usually spawning a shell or
command line
● also performs countless malicious tasks such as sending sensitive information to a remote
attacking computer or even though deletion of data and encrypting a compromised
hard-disk, the list goes on and on.
● These security incidents cause significant damages and financial losses in some cases.
Important Questions
1. Write Short notes on Analysis of hard Drive Forensics Images. 5M
2. Write short notes on Analysis of RAM Forensic Image.5M
3. What is the importance of Malware Analysis and What are the essential skills and tools
needed for malware analysis. 10M
4. Explain in detail about steps in Investigating the Routers. 10M
5. Discuss about Finding the Proof. 5M
6. Discuss Handling Routing Table Manipulation Incidents and Handling Denial-of-Service
(DoS) Attacks