Malware Analysis Bootcamp - File Type Identification

Welcome to the Malware Analysis Bootcamp. We will be covering everything you need to know to get started in Malware Analysis professionally. In this video, we will be taking a look at file type identification, why it is important and the tools we will be using.
Link to slides: docs.google.com/presentation/...
Malware Sample: s3.eu-central-1.amazonaws.com...
Tools & links used in the video:
Windows VM's: developer.microsoft.com/en-us...
Fireye installation guide: www.fireeye.com/blog/threat-r...
Github Repository: github.com/fireeye/flare-vm
◼️Get Our Courses:
Python For Ethical Hacking: www.udemy.com/python-for-ethi...
Ethical Hacking Bootcamp: www.udemy.com/the-complete-et...
◼️Our Platforms:
Blog: hsploit.com/
HackerSploit Forum: hackersploit.org/
HackerSploit Cybersecurity Services: hackersploit.io
HackerSploit Academy: www.hackersploit.academy
HackerSploit Discord: / discord
HackerSploit Podcast: / hackersploit
iTunes: itunes.apple.com/us/podcast/t...
◼️Support us by using the following links:
NordVPN: nordvpn.org/hacker
Patreon: / hackersploit
I hope you enjoy/enjoyed the video.
If you have any questions or suggestions feel free to post them in the comments section or on my social networks.
Social Networks - Connect With Us!
-------------------------------
Facebook: / hackersploit
Twitter: / hackersploit
Instagram: / hackersploit
Patreon: / hackersploit
--------------------------------
Thanks for watching!
Благодаря за гледането
Kiitos katsomisesta
Danke fürs Zuschauen!
感谢您观看
Merci d'avoir regardé
دیکھنے کے لیے شکریہ
देखने के लिए धन्यवाद
Grazie per la visione
Gracias por ver
شكرا للمشاهدة
#MalwareAnalysis

[@m1k3thirteen81]

You are the David Attenborough of Cybersecurity! Can’t get enough! Thank you so much for what you do for the community!

[@HackerSploit]

That is greatly appreciated, I am glad you find value in the content.

[@cherubrock222]

Amazing series! You have a great way of explaining this stuff.

[@eswar5252]

Thanks You saved me a lot of time and drew me out of confusion of what to learn

[@95Biswajit]

Loved it. :).. looking forward to get more in this series.

[@VipulVaibhaw]

Watched it over minutely... thanks for this. :)

[@sametsahin-eh3qj]

You sir are a genius. Huge respect.

[@Chris-ez1ly]

Great video. Thank you as always.

[@Naveenbabuborugadda]

This is the ratest video about Malware Analysis in TH-cam

[@amoghnath3330]

Thanks waiting for this :)

[@hanial-hayyawi4578]

Splendid video

[@ecliptic_at]

great video

[@heavenonearth8]

Thank you.

[@rayamoooooo685]

thanks

[@KishorKumar-re2rs]

Can you please explain what is the entry point and what are its uses?

[@puneetkulkarni2416]

Hello Hackersploit!!! You think I should refer to the book Malware Analysis by Monappa KA?
Which one did you refer?

[@nikhilt3755]

"this program cannot be run in DOS"
this is located inside DOS stub
if you are running on DOS this header is identified and gets executed
else its skips this header
last 16 bits in MZ header tells the address to the PE header
(because DOS header gets skipped in windows 10)
my old memories with malware analysis

[@HackerSploit]

Yes, we have not yet covered headers yet. This will also be explained.

[@nikhilt3755]

@@HackerSploit ok bro
i m just saying what i remembered
its been long while i have learnt
waiting for whole tuts

[@christojojo6590]

Hi, if the cff explorer can find all the info about the file type, then what is the need for all other tools explained in the video(Hexeditor,exeinfo PE)

[@nitczi706]

I'm trying to download the Pestudio manually, but when i run it, it says "The version of this file is not compatible with the version of Windows you're running. Check your computer's system information to see whether you need an x86 (32-bit) or x64 (64-bit) version of the program, and then contact the software publisher."
I tried to find another version to download but I have no success. What can i do? There's another program which could replace the PEstudio?

[@austinmurphy9074]

doesn't host-only adapter allow guest to communicate with host? How is this safe?

[@B14CK.M4M84]

❤❤👍👍

[@blade1551431]

link for sample does not work for me

[@supratickdey7125]

then how to find file type for packed ones

[@Wei-ji9ou]

Can malware activate without execute them ?

[@timoteogarcia1581]

What does MZ stand for?

[@MayankBhardwaj-fy7ge]

😍😍😍😍😍😍

[@cyberi2009]

what about Hebrew in the thanks part

[@_nosma]

Cannot Download the sample, it gives me a 404 error page.

[@choudhary6964]

Is it cryptography?

[@pavanteja2219]

The sample malware not PE right ?

[@theunforgiven2601]

why it doesn't work for me?
it keeps telling me that it cant open the file because if may contain viruses.
when ever i drag the malware to the hex editor or any other program.
please help x(
note that it was working before, and all of sudden it didn't work again x( x(

[@theunforgiven2601]

@Nathan Jenkins i did.. but still the malware didn't open.
However, i used linux. And it's working :p

[@qwerty.760]

@@theunforgiven2601 also dont run it on your main system. Use virtual box/vmware or another isolated system.

[@theunforgiven2601]

@@qwerty.760 Yep... thank you for the advice. i used VM for that :)

[@bobnoob1467]

@@theunforgiven2601 even better, a sandbox environement.

[@dylanzentz4525]

where can i go to find malware? i just want the source code of viruses. Where can i find them?

[@ProfChoy]

Have you found them? I think GitHub has it

[@SatyamKumar-ti6hw]

The malware sample is no longer located in the Google drive. Error 404

[@HackerSploit]

The issue should be resolved.

[@MisterK-YT]

Windows Vista? Lol