In this video lesson, we are going to start using your Flavien tools.
This is what it looks like after you have completed the installation of Flavien.
And there's a folder here.
If you click on it, it contains some of the tools.
And you can enter the fold and you see the cut.
To run those shoes, for example, this is a hex to attitudes can be found here by clicking search and
typing the name of the tool you want.
For example, Ghidorah is here.
Some of them are in a button, your ex 64 I to debugger and either and so on.
So the first thing we are going to try is to try to understand what a false and file formats.
Our malware analyst deals with hundreds of thousands every day.
All of the files and the system need to be categorized so that an analyst understands the potential
damage then one file can do to this system.
A malware analyst needs to be aware of the various file formats and how to identify them.
So how do we visualize a file?
One way is to use the Hex editor.
Hey, hey xda let us try to create a father.
Now everything in the computer is in binary format.
Binary means everything is seeing bits, zeros and ones.
So every file system is consisting of zeros and ones and these zeros and ones that can be viewed in
hex hexameters and other programs.
So he can, for example, create a file that is trying to create a final text file.
Hello, and he had just had a word.
And if we were to open this file, we've not bet any text editor to the program itself would interpret
those binaries to mean something.
For example, these are interpreted as the characters h e l, hello and so on.
We can also use hex editors, for example, if I drag this into a hasty, I can see the same thing.
But this time I get more information.
I can see the binary files.
The binary is being grouped into bytes.
So and they are denoted using hexadecimal notation.
And I can see here that six eight hexadecimal is the letter H.
A six five hexadecimal is a letter E and so on.
And this is how you can visualize, visualize files.
So from here, it's quite obvious that this is really a tax file, as you can clearly see the tax.
This kind of Tharthar uncle hexameters, they allow you to view the raw format of a file by grouping
the binaries, ones and zeros into groups of bytes, each by is presented by Hasan asima and his.
Another useful tool is TriNet, which can be used to identify and identify the type, and you can download
this from the Association for this nature.
This is the file and put them in.
The zero is zero five three eight zero six three zero five Triniti come online version 016.
That is the good version And then after you have put it here just right click the TriNet, drag it to
the desktop and release and create a shortcut here.
So then you have to call you and make sure you sign the definition file because he uses the definition
first to identify far times not to use it.
And then you can put the file you on the skin by dragging you here like this.
And then over here you need to specify where is the location for your definition file and select the
folder.
And in this case, the file, after he has finished scanning the definition for you can analyze the
target.
Just click on this and it will analyze and shows you the percentage match, for example, eighty three
point eight percent.
This is Windows control panel.
Generic file is and this is far from a saying is a window 64 schema and so on.
So from here, you will know the file type here and you don't have to rely on the extension of the icon
that you are seeing.
So these are some of the basic tools for determining file typed in windows.
So that's all for this Hitcher House.
You in the next one.
Thank you for adding.