CS6264 Lab 2: Malware Analysis Summer 2025 LINK
“Good work on that last assignment!” Your boss seems delightfully cheery today. “The client was very impressed by your skills and has requested that you help them with another engagement.”
This is great news, you are already impressing your boss.
“They recently found some malware on their servers, and want you to provide a report on its behaviors. From what I’ve seen, our team has never encountered some of these malware before…”
This seems like less great news.
“Anyways, I expect a report on my desk in 2 weeks!”
It seems like its back to reading the documentation for you.
Assignment
The purpose of this assignment is to evaluate your ability to find certain behaviors of a piece of malware using various static and dynamic malware analysis tools.
You will need to use the malware lab environment we have provided to create a report on all of the trigger commands and behaviors of each command for the provided malware. Please refer to the tutorial presentation to get started!
Feel free to adjust the VM’s memory space after download
In your report, you will need to answer the following questions:
- malware1.exe (60 points):
- What is the address/name of the target function(s)? Please fill out what categories the target function is a member of, as well as its data references, and description of what the basic blocks do in the Excel sheet.
- What trigger words/partial commands spur the binary to act? Please submit the Angr script you used to find these keywords. If they are CNC commands, please use a different row in the Excel sheet and exclude those categories/behaviors from the target function row.
- What behaviors did you find during concrete execution? Please fill this out in the Excel sheet as well as provide proof in the form of a screenshot.
- malware2.exe (30 points):
- What is the address/name of the target function(s)? Please fill out what categories the target function is a member of, as well as its data references, and description of what the basic blocks do in the Excel sheet.
- What trigger words/partial commands spur the binary to act? Please submit the angr script you used to find these keywords. If they are CNC commands, please use a different row in the Excel sheet and exclude those categories/behaviors from the target function row.
- What behaviors did you find during concrete execution? Please fill this out in the Excel sheet as well as provide proof in the form of a screenshot.
- malware3.exe (10 points + 10 bonus):
- We don’t know what kind of malware this is ourselves and would like you to find out! At the very least, we would like you to statically analyze 10 candidate functions and see if you can find the target function and fill out the necessary rows in the Excel sheet.
- You will get extra points if you find triggering commands and succeed in concretely executing the binary in your VM.
VM Link:
GoogleDrive: https://drive.google.com/file/d/1IworK5igEYnlSGppYMUFS1i-OIRtMBdc/view?usp=sharingLinks to an external site.
MD5hash: 904827c5bc644a7b0f0115abb327304d
Supplementary Material:
Lab 2_Supplementary_Material.pdf
Deliverables
- A .tar.gz file containing the report, Angr scripts, and proof of concrete execution. Name this [username]_lab02.tar.gz
- A report in the form of an Excel sheet on all commands for the malware and the behavior of each command. This will be graded based on the completeness of your investigation. The template can be found here: lab02_report.xlsx Download lab02_report.xlsx.
- A detailed writeup about each steps you took to explore these malware
- A folder for each malware (at least the first 2), each named malware[#], containing:
- Proof of concrete execution for the first two malware in the form of screenshots that display the result of the behavior. Ideally, each of the screenshots is named so that it is obvious as to what the screenshot is displaying.
- Angr scripts for each malware (at least for the first 2). These should be called malware[#]_inputs.py (python3 script)
- Sample Structure after unzip:
- dzhang377_lab02/
- malware1/
- malware1_inputs.py
- screenshots1.{jpg/png/…}
- screenshots2.{jpg/png/…}
- …
- malware2/
- malware2_inputs.py
- screenshots1.{jpg/png/…}
- screenshots2.{jpg/png/…}
- …
- malware3/
- malware3_inputs.py
- screenshots1.{jpg/png/…}
- screenshots2.{jpg/png/…}
- …
- writeup.pdf
- lab02_report.xlsx
- malware1/
Warning:
Please don’t run the malware on your own computer! We are not responsible if you do. Only execute it inside the Windows VM we are provided. These are real world malware samples.
