1. Please define the obfuscation process in detail. 2. Using http://www.dependencywalker.com pl

1. Please define the obfuscation process in detail.

2. Using http://www.dependencywalker.com please explain the components involved within the .dll GetCurrentProcess.dll along with how the process works. Please provide a snapshot of your findings.

3. Answer the questions relating to Lab1-2:

Q: 1. Upload the Lab01-02.exe file to http://www.VirusTotal.com/ . Does it match any existing antivirus

definitions? 

Q: 2. Are there any indications that this file is packed or obfuscated? If so, what are these

indicators? If the file is packed, unpack it if possible. 

Q: 3. Do any imports hint at this program’s functionality? If so, which imports are they

and what do they tell you? 

Q: 4. What host-or network-based indicators could be used to identify this malware on infected

machines? 

________________________________________

In this assignment, you will need to setup a virtualized environment. See the following:

https://www.osboxes.org

http://www.heaventools.com/download.html

https://www.fireeye.com/mandiant.html

https://www.wireshark.org/download.html

https://regshot.en.softonic.com

Please provide a complete writeup on how this malware could be installed on your machine. NOTE: You will need to disable any anti-virus protection as this contains live malware. It will not install onto your system. 

Analyze the malware found in the file Lab03-02.dll using basic dynamic

analysis tools. 

How can you get this malware to install itself?

How would you get this malware to run after installation? 

How can you find the process under which this malware is running?

Which filters could you set in order to use procmon to glean information? 

What are the malware’s host-based indicators? 

Are there any useful network-based signatures for this malware? 

How could you prevent this type of malware from installing on your machine?

PLEASE COPY AND PASTE QUESTIONS IN DOCUMENT AND ANSER THEM ACCORDINGLY.