Detailed Report on Malware Analysis

Malware Analysis Assignments – Report Preparation Request

This project involves preparing detailed LaTeX-based reports for five malware analysis assignments from the DV2613 course. All assignment materials, including screenshots, videos, and setup guides, are available at the following link:

Google Drive Folder: https://drive.google.com/drive/folders/15e2oCqpY46EEes_G-zsy1vaq2VNyuyaH?usp=sharing

Each of the five assignments focuses on a different malware analysis task and requires step-by-step execution, proper documentation, and clear explanation. The assignments are as follows:
1. Module 6 – Web Exploits Analysis
• Analyze and deobfuscate HTML-based exploits using the Malzilla tool located in C:\STUDENT_LABS\Tools\Exploit Tools\malzilla_0.9.3pre5\.
• Identify the deobfuscated script, extract the URL from the shellcode used to download the first-stage trojan, and determine the vulnerabilities exploited.
• Follow the video guide for reference and include screenshots for every step.
2. Module 7 – DLL Side Loading Attack Analysis
• Use the file sample available in C:\STUDENT_LABS\Lab5 - Reverse Engineering\.
• Perform static and dynamic analysis of each dropped file.
• Identify the malware type, obfuscation method, and purpose of the dropped files.
• Explain how the malicious payload is executed, provide pseudocode for the decoding of Noew.SAM, and describe the DLL side-loading technique.
• Document each step with screenshots and explanations.
3. Module 8 – Advanced Unpacking of PE Files
• Use the dynamic unpacking method described in the video to unpack applications located in C:\STUDENT_LABS\Lab7 - Advanced Unpacking\.
• Analyze executables packed with UPX, AsPack, FSG, and WinUpack.
• Detect the packer with PEiD, find the Entry Point (EP), determine the Original Entry Point (OEP), dump the unpacked process, reconstruct the Import Address Table (IAT), and verify the unpacked file’s functionality.
• Include the file sizes before and after unpacking, and support every step with screenshots.
4. Module 9 – Morphine Protection Unpacking
• Unpack either calc.exe or notepad.exe protected by Morphine, depending on the SIS ID.
• Since the SSN is 20040112-T173, the last digit (3) is odd, so use notepad.exe and files located in the 03 folder.
• Find the Original Entry Point (OEP), remove unpacking countermeasures, dump the process, and reconstruct the IAT using Import Reconstructor (ImpRec).
• Verify the unpacked binary and name it appropriately (e.g., Dumped_.exe).
• Document every step and explain how obfuscation and anti-debugging were bypassed.
5. Module 10 – Android Malware Analysis
• Analyze an Android ransomware sample found in C:\STUDENT_LABS\Lab8 - Android Malware Analysis\.
• Use the Android emulator or SDK Manager (AVD) with a Nexus S (Android 4.4.2, API 19) configuration.
• Install and run the ransomware APK, observe its behavior, analyze encryption mechanisms, installation and persistence, and patch the ransomware to decrypt files.
• Include all ADB commands, emulator steps, and screenshots demonstrating the analysis and mitigation.
• Reference the VM note: if the default AVD fails, create a new one using the specifications provided in the “Fixing problems with the AVD” guide.

VM Setup Instructions

All assignments must be performed using the Windows XP Lab VM provided in the official materials.
• Download all 7 split parts of the VM archive before extraction.
• Use 7-Zip to unpack the archive and open the .vbox file in VirtualBox to start the VM.
• Login requires no password — press Enter to access the system.
• The files inside the VM are malicious and should never be moved outside the virtual machine.
They are safe only when kept inside the isolated VM environment.

Important Configuration Notes
• For Morphine unpacking: use the 03 folder (since the SSN ends in 3).
• For assignments that specify an odd/even choice, use notepad.exe (odd).
• Use tools like PEiD, IDA Pro, Malzilla, Import Reconstructor, and Android Debug Bridge (ADB) exactly as shown in the provided videos.
• For each step, capture screenshots and add explanations describing what is visible and why it is relevant.

Report Requirements
• Prepare one LaTeX report per assignment.
• Each report must contain:
• Assignment title at the top.
• Space for the student’s Name, Email Address, and Personnummer.
• All answers written clearly and accurately.
• Every step illustrated with screenshots and followed by detailed explanations.
• Proper formatting, structure, and clarity throughout.

Deadline
All reports must be completed by October 28.
If an assignment is finished earlier, please send it immediately for review.

Confidentiality and Usage
All provided files, instructions, and virtual machines are strictly confidential.
They must not be shared, distributed, or used outside the scope of this coursework.
Do not attempt to extract, copy, or analyze the malware samples on your host system.
Any misuse of these materials or violation of confidentiality will result in permanent disqualification from the project.