# i-got-a-virus

**Catégorie:** Forensic\
**Difficulté:** Facile\
**Flag:** -

## Challenge

{% file src="https://2344605990-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vTwbgJFy6k3bN4a9ntp%2Fuploads%2FNLrr6Ipc9Gl1X1KvSKxt%2Fmalware-sample.zip?alt=media&token=14473e9f-f06e-49ee-a640-d5e437cb222e" %}

{% hint style="info" %}
#### Description

***

We need to understand the capabilities of this malicious file. WARNING: THIS CHALLENGE CONTAINS REAL MALWARE AND SHOULD BE TESTED IN AN SANDBOX ENVIRONMENT the entire challenge is solvable using VirusTotal.
{% endhint %}

## Solution

Ce challenge est une suite de questions, direction **VirusTotal** pour analyser le malware.

### Q1. What is the SHA256 of the given file?

C'est écrit tout de suite après avoir upload le fichier, c'est grâce à ce hash que les fichiers sont associés entre eux sur VirusTotal

<figure><img src="https://2344605990-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vTwbgJFy6k3bN4a9ntp%2Fuploads%2FORjrHKUA90x4a3ng9M6l%2Fimage.png?alt=media&#x26;token=8d1201cb-54ae-4a36-8f32-a8af60db3e49" alt=""><figcaption></figcaption></figure>

-> 4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c

***

### Q2. What is the malware family name?

<figure><img src="https://2344605990-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vTwbgJFy6k3bN4a9ntp%2Fuploads%2F18o55fd51J9z79vK2PqI%2Fimage.png?alt=media&#x26;token=2ed8b153-9bf0-4b18-b43d-71eab2972d49" alt=""><figcaption></figcaption></figure>

-> petya

***

### Q3. What type of malware is used for analysis?

<figure><img src="https://2344605990-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vTwbgJFy6k3bN4a9ntp%2Fuploads%2F5ZMsK60keiio6kvAsXvL%2Fimage.png?alt=media&#x26;token=7f83931e-5b19-4504-bb9d-b42a01b598f3" alt=""><figcaption></figcaption></figure>

-> trojan

***

### Q4. Provide the creation date of the malicious file as presented in VirusTotal

Dans l'onglet **Détail**

<figure><img src="https://2344605990-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vTwbgJFy6k3bN4a9ntp%2Fuploads%2Fo7pKm8aaLIWef3PUOLZM%2Fimage.png?alt=media&#x26;token=9d8c8068-ff5f-4f4e-bb91-2d0d9ebf325a" alt=""><figcaption></figcaption></figure>

-> 2016-01-30 02:56:43 UTC

***

### Q5. What is the malicious IP which was marked as malicious used by the given malware sample?

Dans l'onglet **Relation**

<figure><img src="https://2344605990-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vTwbgJFy6k3bN4a9ntp%2Fuploads%2FVhxit3sZO0u0LQnBRZWY%2Fimage.png?alt=media&#x26;token=98c5405a-037c-45cf-889a-8ef3f9e3da37" alt=""><figcaption></figcaption></figure>

-> 13.107.4.52

