Lab1itii.docx

Lab 1 – File Signature Analysis This lab is designed to teach the students to determine if a file has a mismatched file extension, a common method attackers use to deliver malware successfully through firewalls and to hide it from the typical user. For this lab, install the ICY Hexplorer hex editor (hex_setup26.exe) and WinRAR (wrar550.exe) from the Lab 1 folder. Launch ICY Hexplorer and change the font (View > Options… > Font: System Fixed Font). To answer the following questions drag each file into ICY Hexplorer. Use “File Signatures.htm1” as a reference for the file signatures. HINT: Search for the hex characters of the header. 1. file1
 First four bytes: FF D8 FF E1 File Extension/Type: JPG Digital camera JPG using Exchangeable Image File Format (EXIF) 
 Rename the file with the correct extension and open it. What is it? Poză “INCOMING”

2. file2
 First four bytes: 25 50 44 46
 File Extension/Type: PDF, FDF, AI Adobe Portable Document Format, Forms Document Format, and Illustrator graphics files Rename the file with the correct extension and open it. What is it? Document pdf întitulat “On the Effectiveness of Malware Protection on Android”

3. file3

(hint: get from file7) First four bytes: 47 49 46 38 File Extension/Type: GIF Graphics interchange format file
 Rename the file with the correct extension and open it. What is it? Imagine cu textul “THIS IS A BREACH NOTICE ONLY YOU CAN HELP PREVENT MALWARE FIRES”

1

https://www.garykessler.net/library/file_sigs.html

4. file4
 First four bytes: 4D 5A 90 00
 File Extension/Type: ZAP ZoneAlam data file Rename the file with the correct extension and open it. What is it? Nu se deschide.

5. file5
 First four bytes: 49 54 53 46
 File Extension/Type: CHI, CHM Microsoft Compiled HTML Help File
 Rename the file with the correct extension and open it. What is it? SQL Server Configuration Manager Help

6. file6
 First four bytes: D0 CF 11 E0
 File Extension/Type: DOC, DOT, PPS, PPT, XLA, XLS, WIZ Rename the file with the correct extension and open it. What is it? Meniu la “Brick Oven Pizzas”

7. file7
 First four bytes: 50 4B 03 04
 File Extension/Type: ZIP ZLock Pro encrypted ZIPRename the file with the correct Rename the file with the correct extension and open it. What is it? 2 fişiere arhivate: file3 şi file8

8. file8


(hint: get from file7) First four bytes: 3C 68 74 6D
 File Extension/Type: HTML File
 Rename the file with the correct extension and open it. What is it? Pagină web cu instrucţiuni pentru achiziţionarea Winrar sau Rar licenţiat