
Cuckoo Malware Analysis

Now after we dump the memory, we need to do some forensics on it. The tool we will use is called Volatility Framework. It can extract digital artifacts from volatile memory (RAM) dumps. Volatility can analyze RAM dumps from 32-bit and 64-bit Windows, Linux, Mac OS, and Android systems.
Download the latest Volatility available.
After you finish downloading the file, you have to extract the files into a folder:
$ tar -zxvf volatility-2.2.tar.gz
Find the latest Volatility download link here: https://code.google.com/p/volatility/wiki/VolatilityIntroduction
Change the directory to volatility-2.2
:
$ cd volatility-2.2/ $ ls
Our memory analysis will be using the vol.py
file.
For a detailed documentation about using Volatility, please see the following Wikipedia links:
https://code.google.com/p/volatility/wiki/Release22
https://code.google.com/p/volatility/wiki/CommandReference22
Change the font size
Change margin width
Change background colour