>> Hey everyone, welcome back to the course.
In the last video, we went ahead
>> and created our malicious file.
>> If you haven't done that yet,
>> if you haven't watched that video,
>> definitely pause this one
>> because you will need that file
>> as we go through this entire lab.
>> Pause this video, go back to that last one
>> and make sure you get that file created.
>> We also went ahead
>> and looked for any malicious signatures in the file.
>> We ran a quick scan with
Binwalk to see if we found anything.
We also got a visualization of the file.
We use Binwalk again to get a visualization.
As I mentioned in the last video,
I think it looks like
>> the Borg ship cube from Star Trek.
>> In this video, we're going to go ahead
>> and look for any opcodes.
>> In this particular file,
we're also going to perform
>> a hash on this file as well.
>> If you haven't downloaded the step-by-step guide,
be sure to go to the resources
>> and download that particular guide
>> because will like to walk through
>> step-by-step on your own.
>> Because you may find that I go too
slow or too fast in this lab,
so I want to make sure you have
the best experience possible.
We left off and we were at step number 12 here
>> on the step-by-step lab guide.
>> We're going to go ahead and type in this command here.
This Binwalk-A, and then our filename here.
Let's go ahead and do that.
>> We'll go back to our terminal window here.
>> We're going to type in Binwalk, all lowercase,
a space dash capital A,
and then our filenames,
>> which again is malicious file.exe.
>> We'll go ahead and type that in.
We'll see if we get any opcodes or nopcodes back
>> and nopcodes are just no operation opcodes.
>> We see here that we do get them back.
If you look here,
>> you should see that you've got them here.
>> Let's go back to our lab guide here.
Question number 1 is,
do you see any new operation opcodes?
In my example, yes,
I do see them and you should
also see the same thing on your side.
Next, we're going to type in
this command here for Step 13.
Let's go back to our a command prompt here.
We're going to type in exiftool space,
and then our filename, so malicious file.exe.
This will just give us some additional information
about this malicious file.
You'll see here it gives us
>> some very basic information,
>> version number, etc.
It may or may not be helpful information
>> as we're analyzing these,
>> but just another step in the process.
Finally, the last thing we're going to do in our labs,
we're going to go ahead
>> and perform a hash on this particular file.
>> It's very important to perform a hash
that way if you see this malware again,
especially if you're working
with an antivirus company, for example,
a lot of them use signature-based
along with heuristic analysis and stuff.
Signature-based when we talk about that
>> or if you've heard that terminology before,
>> that's what we're talking about here.
Let's go ahead and just type in that last command,
it's going to be MD5deep space malicious file.exe.
We're just going ahead and run that.
It's going to give us the hash of this particular file.
You see the hash right there,
it's a bunch of letters and numbers.
In this video, we just went ahead
>> and wrapped up our labs.
>> We went ahead and we looked for a no operation,
opcodes and the malware.
We also went ahead
>> and got some additional information
>> using the ExifTool,
>> and then we just wrapped up
by hashing this malicious file.
In the next video, we're going to go ahead
>> and start our additional lab in this course,
>> which is going to be the rootkit lab.
As I mentioned before,
the rootkit we're using is a very old one.
I believe way back in 2004 is when it was created.
However, it allows us to get some of the fundamentals
>> and actually be able to analyze it.
>> We'll see you in the next video.