CYBERSIM
INTERACTIVE CYBERSECURITY LAB
← All modules
Home/Module 06
MODULE 06 / 08 · THREAT ANALYSIS

Malware Analysis & Threat Investigation

Learn how analysts examine suspicious files, interpret behavioural indicators, investigate a simulated incident and document defensible conclusions. This module combines a consent-based environment profile with an inert malware-analysis case.

Learning objectives

By the end of this module, you should be able to distinguish static and behavioural evidence, recognise common indicators of compromise, use cautious analyst language and understand why real malware requires an isolated analysis environment.

01 · InspectReview browser-reported environment attributes and understand their privacy implications.
02 · InvestigateAnalyse simulated file, process, persistence and network evidence.
03 · ReportMake a proportionate verdict and produce an investigation report.
Safety boundary — read before starting

This GitHub Pages exercise does not download, upload or execute malware. The malware case contains synthetic training telemetry. The Environment Inspector reads selected browser-provided properties only after consent; it does not create a persistent device ID, store results or transmit them to a server. This is a learning tool, not antivirus software and not proof that a device is clean.

01 · Environment Inspector

Consent-based browser and device profile

LOCAL BROWSER INSPECTION

Understand the environment you're using

Analysts record relevant host context when documenting an investigation. This exercise shows a small set of browser-reported properties. Combined attributes can contribute to browser fingerprinting, so the inspection is optional and deliberately limited.

Privacy notice: The inspection may read your browser's user-agent string, reported browser/OS family, screen and viewport dimensions, language, time zone, touch capability and available hardware hints. These values can be inaccurate or masked. No canvas, audio or WebGL fingerprinting is performed.

What will happen if you consent?

  • Read the listed properties from your current browser session.
  • Display the results on this page so you can inspect them.
  • Do not send the results to a server, save them in browser storage or generate a persistent unique identifier.
  • You can clear the displayed results at any time.
Environment profile● Processed in this browser only
Browser user-agent string
Interpretation: browser identification is best-effort. User-agent strings can be reduced, spoofed or changed by browser privacy settings. This profile is not a reliable unique identity and does not detect malware.

02 · Malware Analysis Sandbox

Guided investigation of an inert training case

SYNTHETIC TELEMETRY · NO EXECUTION

Case file: Invoice Viewer

Ready for analysis

A staff member reports an unexpected invoice attachment. The following artefacts were authored for this training exercise. They are not generated by executing a file and must not be presented as results from a real malware sample.

TRAINING SAMPLE · CSIM-MAL-006INERT CASE DATA
Filenameinvoice_viewer_training.exe
Claimed typeWindows PE executable
Reported size248 KB (synthetic)
File hashNot provided — no binary
SourceReported email attachment
Initial priorityUNTRIAGED
No executable is included in this page. The filename and metadata are fictional case details.
Analyst discipline: An indicator is not automatically proof of compromise. Correlate evidence, consider benign explanations and state what you cannot establish.

Static triage observations

These are supplied case notes. No file parser, antivirus engine or hash calculation runs in the browser.

ObservationEvidencePriority
File originUnexpected invoice attachment from an unfamiliar senderREVIEW
File typeExecutable extension inconsistent with an ordinary invoice documentHIGH
HashNo actual binary supplied; cryptographic hash unavailableUNKNOWN
SignatureDigital-signature status not suppliedUNKNOWN

Simulated process activity

Illustrative process tree recorded in the fictional incident notes. It is not a live process list from this computer.

explorer.exe └── invoice_viewer_training.exe [synthetic event] └── powershell.exe [command arguments redacted] └── child activity [details not supplied]
An unexpected document viewer spawning a scripting interpreter would warrant investigation. This scenario does not establish what the child process actually did.

Simulated network observations

Addresses below are reserved for documentation and examples; they are not live destinations and this page does not contact them.

TimeObservationDestinationAssessment
10:14:02DNS lookup (synthetic)cdn-update.training.invalidREVIEW
10:14:05Outbound TLS session (synthetic)198.51.100.24:443REVIEW
10:14:09Connection attempt (synthetic)203.0.113.18:443UNCONFIRMED
The IP addresses are documentation-only TEST-NET ranges. A connection to an unfamiliar destination alone does not prove data theft or command-and-control.

Analysis event timeline

Run the simulated analysis to populate the investigation sequence.

  1. Awaiting analyst action

    Select “Run simulated analysis” to review the training evidence.

03 · Analyst verdict

Based on the supplied evidence, choose the most defensible conclusion. Avoid claiming more than the evidence supports.

Quarantine in this page is a workflow demonstration only. It does not move, delete, block or isolate any real file or process.

04 · What a real malware sandbox does

The public learning page is not a real execution sandbox. A genuine analysis environment requires separate infrastructure and disposable virtual machines. Tools such as CAPE can execute submitted samples in isolated guest VMs and collect behavioural artefacts; REMnux provides a toolkit for static and dynamic analysis, memory forensics and network investigation.

Isolated executionAnalyse only in a dedicated disposable guest with controlled networking and snapshots.
Evidence collectionCollect process, file, memory and network artefacts through a dedicated analysis platform.
Sanitised reportingPublish findings and screenshots, never malware binaries, secrets or raw sensitive captures.
Do not run real malware on your everyday computer. Do not upload suspicious binaries to this GitHub Pages site. Disable host/guest shared folders, clipboard, drag-and-drop and USB passthrough in any dedicated analysis VM; use an isolated network and follow an approved lab procedure.

Professional takeaway

Malware analysis is evidence-led. Separate observations from assumptions, preserve hashes and artefacts when a real sample is authorised for analysis, correlate host and network behaviour, and report uncertainty. A suspicious indicator justifies further investigation; it does not automatically prove malicious intent.