DEPARTMENT

OF
COMPUTER SCIENCE ENGINEERING W/s CYBER SECURITY

(LAB RECORD)
(ACADEMIC YEAR: 2025-2026)

CB3001 MALWARE ANALYSIS

Name :

Register Number :

Department :

Year/Semester :

Subject Code :

Subject Name :
 BONAFIDE CERTIFICATE

This is to certify that Mr./Ms....................................................................... of

...........year.......................Semester B.E./[Link] (...........................................

. .................................................................) is a bonafide student bearing the

[Link] ........................................................... and record of work done in the

. .................................................................................................. lab during

the academic year 2025-2026

Faculty In-Charge Head of the Department

Submitted for the Practical Examination held on.................................

Internal Examiner External Examiner

 GENERAL INSTRUCTIONS FOR LABORATORY
All the students should report to the lab in time, failing which, will not be permitted.
The students should brief the safety precaution and procedure for the particular experiment to
the faculty before starting the experiment.
While conducting experiment show the sample reading to the faculty and get approval for the
reading.
After completing the experiment do the calculation, graph and analysis of results and get the
sign from the faculty.
Every lab class, student should submit the lab record book failing which they are not permitted
to perform any experiment on the day.
Students are instructed to do the experiments individually. Students are strictly instructed to
follow the lab safety instructions.
After completing the experiments clean the workspace and switch off the electrical connections.
Switch off the lights and fans not in use.
Damaging of equipment and tools by improper handling will be taxed. Handle the precision
instruments carefully.
Keep the instruments in the appropriate places. Keep distance with rotating and hot
components. Wear goggles and gloves where ever needed.
Handle the greasy components with care.
Avoid watches, ornaments while doing experiments.
Don’t operate the equipment’s without knowing the procedure. Misbehaviour in the labs
will be viewed seriously.
Wear proper dress code (Formal dressing with shoes)Report the accidents immediately to the
faculty in-charge.

FOR COMPUTER LABS

Don’t use pendrive, memory card and other electronic gadgets without permission. Without
prior permission don’t install / uninstall any software not related to lab.
Save the worked file in your login folder only.
After completing the experiments shutdown the system properly and switch off the electrical
connection.
 List of Experiments

1. Initial Infection Vectors and Malware Discovery

2. Implementation on Sandboxing Malware and Gathering Information from Runtime Analysis

3. Implementation on Portable Executable (PE32) File Format

4. Implementation on Executable Metadata and Executable Packers

5. Experimentation on Malware Self-Defense, Compression, and Obfuscation Techniques

6. Experimentation on Malware Behaviour Analysis

7. Experimentation on Analyzing Malicious Microsoft Office and Adobe PDF Documents
8. Experimentation on Mobile Malware Analysis
9. Experimentation on Packing and Unpacking of Malware
10. Experimentation on Rootkit Anti-Forensics and Covert Channels
11. Experimentation on Modern Rootkit Analysis
12. Experimentation on Malware Traffic Analysis

Course Outcomes:

Upon completion of the course, the student will be able to

CO1: Understand and identify malware infection vectors, propagation methods, and initial compromise
techniques through static and dynamic analysis.

CO2: Apply sandboxing, runtime analysis, and behavioral analysis techniques to safely execute and study
malicious software.

CO3: Analyze Portable Executable (PE) files, executable metadata, and packing mechanisms to detect
malicious characteristics and hidden code.

CO4: Examine and evaluate advanced malware techniques such as self-defense, obfuscation,
compression, packing, rootkits, and anti-forensics mechanisms.

CO5: Use industry-standard malware analysis tools to investigate malicious documents, mobile malware,
rootkits, and network traffic for threat detection and incident response.
 [Link]
Date
Name of the experiment

Performing the
Index

experiment (5
marks)

Completion of
the record
work (5 mark)

Technical
Knowledge
(5 mark)

Attendance (5
Marks Awarded day to day activities

marks)
the

with
Date
Sign of

Faculty
 INTERNAL SIGNATURE OF THE
MAX MARKS MARKS AWARDED
CALCULATIONS FACULTY
Average of Day-to-Day 20
Activity
Model Exam 20

Assignment/Simulation 10

Total 50

Signature of the Student Signature of the Lab Incharge

Experiment 1: Initial Infection Vectors and Malware Discovery

Aim

To study common initial infection vectors used by malware and perform basic malware
discovery using static indicators.

Tools Required

• Virtual Machine (Windows & Linux)

• VirusTotal (offline reference)
• YARA
• Hashing tools (MD5/SHA256)
• Wireshark (optional)

Theory

Initial infection vectors are methods used by attackers to deliver malware to a victim
system. Common vectors include phishing emails, malicious attachments, drive-by
downloads, USB devices, and software supply-chain attacks. Malware discovery involves
identifying suspicious files using hashes, signatures, and heuristic indicators.

Procedure

1. Set up an isolated virtual machine.

2. Collect sample files from controlled lab sources.

3. Generate cryptographic hashes of samples.

4. Compare hashes with known malware databases.

5. Identify indicators such as abnormal file size, suspicious names, and unexpected
locations.

Observation

• Suspicious executables often hide in system directories.

• Hash-based detection is fast but ineffective for polymorphic malware.

Result

Initial infection methods and basic malware discovery techniques were successfully studied.
Experiment 2: Implementation on Sandboxing Malware and Gathering Information
from Runtime Analysis

Aim: To analyze malware behavior dynamically using sandboxing techniques.

Tools Required

• Cuckoo Sandbox / [Link] (offline simulation)

• Process Monitor

• Process Explorer

• Regshot

Theory

Sandboxing executes malware in a controlled environment to observe runtime behavior

such as file creation, registry changes, process injection, and network activity.

Procedure

1. A secure sandbox environment was configured using a virtual machine with

monitoring tools installed.

2. Initial system state was captured using Regshot to record registry values before
execution.

3. The malware sample was executed inside the sandbox.

4. Process Monitor was used to observe file system access, registry changes, and
process creation.

5. Process Explorer tracked running processes and detected suspicious child

processes.

6. Network activity was monitored to identify outbound connections.

7. After execution, a second registry snapshot was taken using Regshot for
comparison.

Observation

• Malware attempts persistence via registry keys.

• Suspicious outbound network connections observed.

Result

Dynamic analysis provided insight into real-time malware behavior.

Experiment 3: Implementation on Portable Executable (PE32) File Format

Aim: To study the internal structure of PE32 executable files.

Tools Required

• PEview

• PE Explorer

• Hex Editor

Theory

The Portable Executable format defines the structure of Windows executables, including
headers, sections, import/export tables, and resources. Malware often manipulates PE
structures to evade detection.

Procedure

1. The executable file was loaded into PEview for basic structural inspection.
2. The DOS Header was examined to verify the MZ signature and offset to NT Header.
3. The NT Header was analyzed to observe file characteristics and optional header
values.
4. The Section Table was reviewed to identify section names, sizes, and permissions.
5. The executable was opened in PE Explorer to visualize imports, exports, and
resources.
6. A Hex Editor was used to inspect raw bytes and verify header consistency.
7. Any anomalies such as unusual section names or abnormal sizes were noted.

Observation

• Unusual section names indicate packed malware.

Result

Understanding of PE32 file format was achieved.

Experiment 4: Implementation on Executable Metadata and Executable Packers

Aim: To analyze executable metadata and identify packing techniques.

Tools Required

• Detect It Easy (DIE)

• PEiD

• Exeinfo

Theory

Executable metadata includes compile time, imports, and version info. Packers compress or
encrypt executables to hide malicious code.

Procedure

1. The executable file was loaded into Detect It Easy (DIE) to identify compiler details,
entropy levels, and possible packer signatures.
2. PEiD was used to scan the executable for known packers and cryptors.
3. Exeinfo was utilized to cross-verify packing information and observe executable
characteristics.
4. Metadata such as compile time, imports, and version information was examined.
5. A comparison was made between packed and unpacked executables to observe
structural differences.
6. Indicators such as missing imports, high entropy, and unknown packers were noted.

Observation

• Packed files show fewer imports.

Result

Metadata and packer identification was performed successfully.

Experiment 5: Experimentation on Malware Self-Defense, Compression, and
Obfuscation Techniques

Aim: To study malware techniques used to evade detection.

Theory

Malware uses anti-debugging, encryption, compression, and obfuscation to resist analysis.

Procedure

1. The malware sample was executed inside a controlled virtual environment with
debugging tools enabled.
2. A debugger was attached to the malware process to observe its execution flow.
3. The behavior of the malware was monitored to detect anti-debugging techniques
such as debugger detection, execution delays, and abnormal program termination.
4. The executable was analyzed to identify compression techniques by observing
packed sections and high entropy regions.
5. Obfuscated code patterns such as encrypted strings, indirect jumps, and junk
instructions were examined.
6. Runtime behavior was observed to check whether the malware altered its execution
when analysis tools were detected.
7. Findings related to self-defense, compression, and obfuscation mechanisms were
documented.

Result

Malware evasion mechanisms were analyzed.

Experiment 6: Experimentation on Malware Behaviour Analysis

Aim: To classify malware based on behavioral patterns.

Tools Required

• Process Monitor

• Wireshark

Procedure

1. Execute the malware sample inside a secured sandbox environment with

monitoring tools enabled.
2. Use Process Monitor to observe system calls, file system activities, registry
modifications, and process creation.
3. Capture and analyze network traffic generated by the malware using Wireshark.
4. Identify suspicious behaviors such as persistence mechanisms, abnormal file access,
and outbound network connections.
5. Compare the observed behaviors with known malware behavior patterns.
6. Classify the malware into the appropriate family based on its behavioral
characteristics.

Result

Behavior-based malware analysis was successfully conducted.

Experiment 7: Experimentation on Analyzing Malicious Microsoft Office and Adobe
PDF Documents

Aim: To analyze document-based malware.

Tools Required

• OfficeMalScanner

• PDFStreamDumper

• Oletools

Theory

Malicious documents exploit macros and embedded scripts to execute payloads.

Procedure

1. Extract embedded macros and scripts from the Microsoft Office and PDF documents
using analysis tools.
2. Analyze the extracted macros, JavaScript, or embedded objects to identify
obfuscation techniques.
3. Examine the code logic to understand how the malicious payload is executed.
4. Identify exploit techniques used to trigger macro execution or script execution.
5. Document indicators of compromise such as suspicious functions, URLs, or encoded
payloads.

Result

Malicious document analysis was completed.

Experiment 8: Experimentation on Mobile Malware Analysis

Aim :To analyze Android malware samples.

Tools Required

• Android Emulator

• APKTool

• JADX

Procedure

1. Decompile the Android APK file using APKTool to extract source files and resources.
2. Analyze the application manifest to review requested permissions and identify
suspicious components.
3. Examine the decompiled source code using JADX to understand malicious logic and
API usage.
4. Install and execute the application inside an Android Emulator.
5. Monitor runtime behavior such as network communication, background services,
and data access.
6. Record observations related to malicious activities and document the findings.

Result

Mobile malware analysis techniques were studied.

Experiment 9: Experimentation on Packing and Unpacking of Malware

Aim

To pack and unpack malware samples.

Tools Required

• UPX

• Debugger (x64dbg)

Procedure

1. Pack the executable file using UPX to create a compressed malware sample.
2. Verify the packed executable to confirm changes in size and structure.
3. Execute the packed malware inside a controlled environment.
4. Use a debugger such as x64dbg to analyze the unpacking routine.
5. Unpack the executable manually or automatically to retrieve the original binary.
6. Compare the packed and unpacked binaries to observe differences in structure and
behavior.

Result

Packing and unpacking techniques were demonstrated.

Experiment 10: Experimentation on Rootkit Anti-Forensics and Covert Channels

Aim :To study rootkit hiding and covert communication techniques.

Theory

Rootkits hide processes, files, and registry entries. Covert channels hide data in legitimate
traffic.

Procedure

1. Execute the rootkit sample inside a secured and isolated virtual environment.
2. Monitor system processes, files, and registry entries to detect hidden or
manipulated objects.
3. Analyze system behavior to identify rootkit techniques used to evade detection.
4. Observe network traffic to identify covert channels hidden within legitimate
communication.
5. Correlate system-level hiding techniques with covert communication methods.
6. Document all identified anti-forensics and covert channel techniques.

Result

Rootkit anti-forensics techniques were analyzed.

Experiment 11: Experimentation on Modern Rootkit Analysis

Aim: To analyze modern kernel-level rootkits.

Tools Required

• Volatility Framework

• Kernel Debugger

Procedure

1. Capture a full system memory dump from the infected machine for analysis.
2. Load the memory dump into the Volatility Framework for examination.
3. Analyze running processes and kernel modules to identify hidden or suspicious
entries.
4. Inspect kernel hooks and modified system structures using kernel debugging
techniques.
5. Correlate memory analysis results to confirm the presence of kernel-level rootkits.
6. Document the findings and observed rootkit behaviors.

Result

Modern rootkit analysis was performed.

Experiment 12: Experimentation on Malware Traffic Analysis

Aim

To analyze network traffic generated by malware.

Tools Required

• Wireshark

• Network Miner

Procedure

1. Execute the malware sample inside a controlled environment with network

monitoring enabled.
2. Capture all network traffic generated by the malware using Wireshark.
3. Filter and analyze packets to identify suspicious communication patterns.
4. Detect command-and-control (C2) server communication and abnormal protocols.
5. Use Network Miner to extract indicators such as IP addresses, domains, URLs, and
transferred files.
6. Document the observed malware traffic patterns and indicators of compromise.

Result

Malware traffic patterns were successfully analyzed.