Building a Malware Analysis Lab
LetsDefend
What is the actual extension of the “XMoon.bin” file?
A) exe
What are the first 4 characters you will see when you open the XMoon.bin file with the Hex editor?
A) 4D5A
What is the signature value of “financials-xls” file?
A) UPX -> www.upx.sourceforge.net
What is the actual file size of the “financials-xls” file? (byte)
A) 43520
What is the domain address where the “e-Archive Dekont” file sends the DNS request?
A) 5gw4d.xyz
File “e-Archive Dekont” has created a scheduled task. What is the action value of this task? (Full path)
A) C:\Users\LetsDefend\AppData\Roaming\VbxFiQYCyFDgGL.exe