Imagine you work for a 60-employee company that performs forensic investigations of employees’ use of company equipment (usually computers and mobile devices). The company has seven different U.S. federal agencies as its only clients and generally works directly with their human resources department. Many of these agencies must complete annual risk assessments of their IT infrastructure and will investigate random employees every year. They will also investigate employees that they think might be misusing organizational resources. You work in their IT department with three other individuals (IT department head, hardware specialist, and software specialist). You mainly work on risk assessments and educating the company employees on how to keep the IT systems safe. You also serve as the incident response manager.
One major risk you have been worried about is malware. It can be embedded in almost any file, from a photo to a PDF document, and has caused IT issues a few times this year. While it is important for forensic investigators to be able to search for malware within a file using the latest forensic techniques, it is also important for your forensic investigators not to infect your companys computers when they are investigating malware.
You have decided to conduct a malware investigation safely and share the results with your companys investigators.
Complete the following steps:
- Select a PDF file, a Microsoft Office file, and a third file of your choosing that is not a PDF or Microsoft Office file
- Identify static malware analysis software tools you will need and install them, if needed. You can use online tools such as malwaretracker.com, malwr.com, or virustotal.com.
- Identify safety precautions you need to take to keep your computer free from malware
- For this assignment, you will consider the files as having a high risk of containing malware. Perform static analysis on the file that should include the following steps:
- Search for hidden code or programs.
- Search for PE headers.
- Search for potentially malicious strings.
- Search for linked libraries.
- When relevant, review or disassemble the code.
Write a 1- to 2-page report on the potential risk of malware in the three files and how the investigators should handle malware when investigating it. Your report should do the following:
- Document the important aspects of output from any software used.
- Document all suspicious elements of the file and any suspicious aspects of the code, which could include DLLs, packages, or strings.
- Describe each files risk level for containing malware.
- Describe how you were able to perform the malware investigation while minimizing the risk of infecting company computers.
- Recommend steps investigators should take to reduce the risk of malware exposure at the company.

Leave a Reply
You must be logged in to post a comment.