courses

Malware Triage

Due Date: 2026-04-13 23:59:59
Submission: via GitLab repo

Introduction

This homework is intended to verify that you have a functional malware analysis workstation and to introduce basic triage techniques. Triage is the first step in any analysis: quickly determining what you’re dealing with before committing to a deep dive.

All work will be submitted via Markdown documents within a GitLab repo. You will use this repo for the rest of the term.

Tasks

  1. Create a private GitLab repo called malware-S26-<CECS> (replace <CECS> with your MCECS username) and clone it to your REMnux VM. Add dmcgrath and gtn as a member (Developer or higher).
  2. Create a folder within the repo called hw1. All documentation for this assignment goes here in a file called hw1.md.
  3. Perform the steps in the setup document. This includes some accounts you will need, creating your VM, and installing some specific tools and libraries that exist outside the setup.sh script.
  4. Take a clean VM snapshot after setup is complete. Document the snapshot in your hw1.md.

  5. Obtain the sample set from ada.cs.pdx.edu:/stash/malware_re/hw1/ using scp. These are benign or known samples — do not execute them.

     $ scp -r <MCECS>@ada.cs.pdx.edu:/stash/malware_re/hw1/ ~/malware/samples/hw1/
  6. For each sample in the set, perform triage using the tools below and document your findings in a table in hw1.md:
    • file — identify the file type
    • sha256sum — compute the hash
    • strings — extract printable strings; note anything interesting
    • binwalk — check for embedded files or compression
    • Check each hash against VirusTotal and record the detection ratio and any family names reported

    Your table should have columns: Filename, File type, SHA-256, Notable strings, VirusTotal hits.

  7. Write a short paragraph (3–5 sentences) for each sample summarizing what the triage results suggest about its purpose or behavior.

Submission

Commit and push hw1/hw1.md along with any screenshots. The markdown file should contain the triage table and per-sample summaries. Once pushed, the assignment is submitted.