Final Project: Malware Analysis Report

Due Date: 2026-06-12 23:59:59

• Final Project: Malware Analysis Report
  • All Students
    • Introduction
    • What You Must Do
    • What to Turn In
    • Grading Criteria
  • Graduate Students (CS 592)
    • Additional Requirements

All Students

Introduction

You will perform a complete, end-to-end analysis of an unknown malware sample and produce a professional-grade analysis report. This project synthesizes all of the skills developed during the term: triage, static analysis, dynamic analysis, anti-analysis bypass, malware classification, shellcode analysis, and automated analysis via fuzzing and symbolic execution.

The sample set is described in the below table. Find your assigned family using the last digit of your university ID number. Quakbot is unassigned and available as an extra credit family — perform the same full analysis on it for additional credit.

What You Must Do

Perform a thorough analysis of your assigned sample using all techniques covered in the course:

1. Triage — file type, hash, packing detection, VirusTotal check
2. Static analysis — PE/ELF structure, imports/exports, string extraction (including FLOSS), IDA Classroom and Cutter disassembly and decompilation
3. Dynamic analysis — strace/ltrace, Wireshark network capture, sandbox submission (Any.run or Hybrid Analysis)
4. Anti-analysis — identify any techniques present and document your bypass approach
5. Classification — determine the malware family/type and justify with evidence
6. IOC extraction — compile a complete list of indicators of compromise
7. YARA rule — write a detection rule for your sample
8. Shellcode (if applicable) — if the sample contains or drops shellcode, analyze it: identify the position-independence mechanism, resolve the API hashing or name-matching routine, and document what the shellcode does
9. Automated analysis (optional, extra credit) — apply AFL++ or angr to the sample or an associated dropper; document what the automated tool found that manual analysis did not

What to Turn In

Submit via your GitLab repo in a directory called final/. The primary deliverable is final/final.md, a professional malware analysis report with the following sections:

• Executive Summary — 1 paragraph non-technical summary suitable for a manager or client
• Technical Summary — brief overview of the sample and key findings
• Triage Results — file metadata, hashes, packing info, VirusTotal results
• Static Analysis — PE/ELF structure findings, notable imports, IDA/Cutter analysis with annotated screenshots
• Dynamic Analysis — behavioral findings from tracing and network capture, sandbox comparison
• Anti-Analysis Techniques — techniques observed and how you addressed them
• Classification — malware family, capabilities, likely threat actor targeting (if determinable)
• Indicators of Compromise — complete IOC table (file hashes, file paths, registry keys, network indicators, mutex names, etc.)
• YARA Rule — detection rule for the sample (also saved as final/rule.yar)
• Methodology — describe your analysis workflow and tools used
• Limitations — what you could not determine and why

Include all supporting screenshots within the final/ directory, referenced from the markdown.

Grading Criteria

• Completeness: all required sections present and substantive
• Accuracy: findings are correct and well-supported with evidence
• Clarity: report is well-organized and understandable
• IOC quality: IOCs are specific and actionable
• YARA rule: rule is functional and not overly broad

Graduate Students (CS 592)

Additional Requirements

In addition to the full analysis above, graduate students must also complete one of the following:

Option A: Comparative Analysis

Obtain a second sample from the same malware family as your assigned sample (use MalwareBazaar or a similar public repository). Perform triage and basic static analysis on the second sample and write a 1–2 page comparison:

• What code or behavior do the samples share? (shared functions, strings, network infrastructure)
• What differs between them? (version differences, new capabilities, rebranding)
• What does this suggest about the malware author’s development practices?

Submit this as final/final-592.md.

Option B: Threat Intelligence Report

Research the threat actor or campaign associated with your malware sample. Using only public sources (threat intelligence reports, academic papers, vendor blogs), write a 2–3 page threat intelligence summary covering:

• Known attribution (nation-state, criminal group, hacktivist, etc.) and confidence level
• Historical campaigns using this malware family
• Typical targets and TTPs (MITRE ATT&CK mapping)
• Defensive recommendations for an organization targeted by this actor

Submit this as final/final-510.md with a bibliography of all sources.

Option C: Automated Analysis

Apply fuzzing and symbolic execution to a component of your assigned malware or its associated dropper/loader:

• Fuzz the sample (or a parsing function extracted from it) with AFL++ for at least 30 minutes. Document the corpus, any crashes found, and their root cause.
• Use angr to automatically explore at least one interesting function — for example, a license/C2 check, a decryption routine, or an anti-analysis condition. Write a script that solves for the input that bypasses or triggers the behavior.
• Compare what the automated tools found versus what manual analysis revealed.

Submit this as final/final-510.md including your AFL++ crash inputs and angr solve scripts.