After the above is done, take a snapshot of the guest SP in VBox.

The file name is ' Max++ downloader install_2010'.

* Download the Malware instance of Max++ from (instructions available in.

Note: get the free version but not the evaluation version - it does not allow saving dbg databases) For the VM itself, assign at least 256MB RAM and 10GB disk space.) on VBox manager.(later we refer to this VM instance as 'guest XP').

Create a Windows XP Guest (using your SP2 installation disk.

Install Oracle Virtual Box v4.04 on your host XP.

( Hofstra students can check out DVD images of VBox instances from my office Adams 203.) The installation process may take about 5 hours. The installation process is straightforward and we omit most of the details here. We will need to download a number of other open-source/free software tools. If the screen resolution is too small, start the XP guest, and then click the ' Install Guest Additions', and then reboot the XP Guest and adjust its screen resolution ('Right click on desktop -> Properties -> Settings'). (later, we refer to this computer: the 'host XP')

A computer loaded with XP, with at least 50GB of disk space.

Linux Ubuntu installation disk (the version we use in this tutorial: Ubuntu 10.04 lucid LTS.

Windows XP SP2 installation disk (Note: it has to be SP2).

Before rolling up your sleeves, please make sure you have the following: The purpose of this lesson is to set up a virtual machine based analysis environment. If you are using this material in your classes, we would appreciate if you follow up with a comment on this site and provide some basic information about your course so that we know our tutorial is helpful.

Instructors are welcome to use this tutorial and integrate it in computer science courses such as computer architecture and operating systems. We assume that you have some basic understanding of X86 assembly, debugging, operating systems, and programming language principles. This mini-series will help you to gain hands-on experiences with the analysis. Giuseppe Bonfa has provided an excellent analysis of the malware. We take a step-by-step approach to analyzing a malware named ZeroAccess. This tutorial is intended for those who are interested in malware analysis. Bonfa's tutorial is perfect a general introduction/analysis of Max++.

Or follow Bonfa's tutoria on the download instructions. For those of you who had trouble with downloading the sample from offensive computing, here is another link:

Hma exe 0xc0000005 download