Tie-In to Lab 1

In Lab 1 you will put this into practice:

• Open a provided sample in PE-bear and identify: bitness, entry point RVA, subsystem, and section layout.
• Convert the AddressOfEntryPoint RVA to a file offset by hand using the section table — then verify with a tool.
• List imported DLLs/APIs and hypothesize the capability (network? injection? persistence?).
• Compute section entropy and flag any packing red flags.
• Script the same triage with pefile and report the imphash.

Deliverable mindset

For each sample, write a short triage note: architecture, notable imports,

packing verdict, and what you would do next. Evidence over guesses.