Welcome back in person.
We are going to do file identification of the malware sample five and we are going to try to identify
whether or not this Trojan is written.
We had a custom back.
So I suggest that you should have downloaded this from the previous and from the resource section.
And Tzipi.
And the password to anticipate is cracking lessons, dot com.
After unzipping, we will now analyze it.
He's treating it to see what type of file his.
We drank the malware sample into treating it.
And in reports, it is an XY p e executable.
Next, we will analyze it with the DIY.
The IEEE stands for Detecting Easy, click on a tree dotted lines and navigate to the folder on a desktop
containing the malware sample and open it.
Detected Easy has failed to detect any PECC.
Let's click on entropy.
Entropy reports that it is not fact.
Next, we will analyze the EIC info.
Drank the marrow sample number five into Yassky in four P, C for P also says that it is not that.
So the next thing to do to confirm whether it is really back or not is to use B studio.
So let's bring up the studio, let us dry the malware into the studio and allow it to start analyzing.
Give it some time.
The studio has finished analysis and clicking on the main link here, you see there is no known signature.
And the fall time is executable, and he has made it so it is happy, executable.
And if you click on libraries, we see the three libraries and very few imports, if you click on the
Iot, we see that very few API functions that are important.
One, two, three, four, five, six, seven, only eight.
So this is positive confirmation that these malware is backed.
We can also click on the sections here and you can find abnormal sections like the two to one to two
to one one and so on, even though the entropy here shows is quite a load, that does not mean it is
not fact.
If you click on the strings here and you scroll down and you'll see that most of it unbreathable again,
a good indicator that dissimilarly is in fact.
So now that we have concluded Dennis Miller is indeed back, we can start to investigate in what way
is it back and how to unpack it.
So we'll do that in the next lesson.
Thank you for watching.