courses

Malware Triage

Due Date: 2026-10-12 23:59:59 Submission: via GitLab repo

Introduction

This homework is intended to verify that you have a functional malware analysis workstation and to introduce basic triage techniques. Triage is the first step in any analysis: quickly determining what you’re dealing with before committing to a deep dive.

All work will be submitted via Markdown documents within a GitLab repo. You will use this repo for the rest of the term.

Tasks

  1. Create a private GitLab repo called malware-f26-<CECS> (replace <CECS> with your MCECS username) and clone it to your REMnux VM. Add dmcgrath and chlu as a member (Developer or higher).
  2. Create a folder within the repo called hw1. All documentation for this assignment goes here in a file called hw1.md.
  3. Perform the steps in the setup document. This includes some accounts you will need, creating your VM, and installing the Remnux environment.
  4. Take a clean VM snapshot after setup is complete. Document the snapshot in your hw1.md.

  5. Obtain the sample set from ada.cs.pdx.edu:/stash/malware_re/hw1/ using scp. These are benign or known samples — do not execute them.

     $ scp -r <MCECS>@ada.cs.pdx.edu:/stash/malware_re/hw1/ ~/malware/samples/hw1/
  6. For each sample in the set, perform triage using the tools below and document your findings in a table in hw1.md:
    • file — identify the file type
    • sha256sum — compute the hash
    • strings — extract printable strings; note anything interesting
    • binwalk — check for embedded files or compression
    • Check each hash against VirusTotal and record the detection ratio and any family names reported

    Your table should have columns: Filename, File type, SHA-256, Notable strings, VirusTotal hits.

  7. Write a short paragraph (3–5 sentences) for each sample summarizing what the triage results suggest about its purpose or behavior.

Submission

Commit and push hw1/hw1.md along with any screenshots. The markdown file should contain the triage table and per-sample summaries. Once pushed, the assignment is submitted.