Browser LabLD-MAL-LAB-001Medium
Browser LabLD-MAL-LAB-001Medium28 min
Static Triage of a Suspicious Attachment
Badr Engineering's mail filter quarantined an attachment named quote.pdf. You have its static analysis output only — magic bytes, hashes, strings, imports and the PE section table. Without ever running it, decide what it really is and what it is capable of. Claim only what static evidence supports.
What you will be able to do
- Identify the true file type from magic bytes, not extension.
- Infer capability from imports.
- Recognize packing from entropy and section flags.
Windows SecurityIOC AnalysisT1027 — Obfuscated/Packed FilesT1055 — Process Injection
Sign in to start this lab.
Sign in