Q:

1. What are this malware’s imports and strings?

Q:

2. What are the malware’s host-based indicators?

Q:

3. Are there any useful network-based signatures for this malware? If so, what are they?

Q:

1. How can you get this malware to install itself?

Q:

2. How would you get this malware to run after installation?

Q:

3. How can you find the process under which this malware is running?

Q:

4. Which filters could you set in order to use procmon to glean information?

Q:

5. What are the malware’s host-based indicators?

Q:

6. Are there any useful network-based signatures for this malware?

Q:

1. What do you notice when monitoring this malware with Process Explorer?

Q:

2. Can you identify any live memory modifications?

Q:

3. What are the malware’s host-based indicators?

Q:

4. What is the purpose of this program?

Q:

1. What happens when you run this file?

Q:

2. What is causing the roadblock in dynamic analysis?

Q:

3. Are there other ways to run this program?