Browse › Forensic Investigations and Evidence Handling
Analyze Packed Executable to Identify Attack Vector and Payload
Part of Forensic Investigations and Evidence Handling Topic: Blue Team
Access
Included in StationX Membership — unlimited attempts
🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
Already have access? Sign in.
New to this? Try a free practice lab — a scripted hacking challenge in your browser, no account needed.
What you'll do
Students will use a handful of tools to analyze a provided suspicious file.
- Using CFF Explorer, they will modify how the suspicious program stores variables in memory, detect what packer it was packed with, unpack that file and then save it in an unpacked state.
- Using ExeinfoPE, they will double-check and ensure that the processed version of the program has been successfully unpacked.
- The students will then run the suspicious program while Process Hacker is running and then dump all strings associated with the suspicious process to a text file.
- Using the dumped strings they will piece together what the program was designed to do.
- ⏱ About 60 minutes
Scored lab. A scored lab checks your work and records a score you can see on the lab page.
Roadmaps that use this lab
- SOC Analyst — career path — step 7: Evidence basics
- Digital Forensics Analyst — career path — step 2: Forensics foundations
