Lecture 1

Question 1

What do we use as the identifier for malware?

Answer 1

Not useful to use filename as an identifier. Better to use the file hash (MD5, SHA1, SHA256) as the identifier.

Question 2

Why should you be weary of online scanners?

Answer 2

You could be uploading sensitive onto the internet. These scanners may store the files. No detection does not mean no malware. Use a hash based file identifier when using online scanners.

Question 3

What are structured files?

Answer 3

The files have a defined structure, such as the header, the data section, the footer etc. The meaning of data changes depending on where it is in the file. For us this also mean, we can look at certain sections of structured files to gain more information about it. Eg, .exe, .pdf, .png etc.

Question 4

What are unstructured files?

Answer 4

No defined structure.