malware-triage · diff
git:20260412.09f91e4 to git:20260905.fd80b2a
159 added, 447 removed. Audit A to A.
---
name: malware-triage
- description: Rapid assessment, classification, and prioritization of malware samples. Use when you need to perform initial malware assessment, classify a sample's type and family, determine analysis priority, identify quick indicators, or decide on next analysis steps.
+ description: Rapid static assessment, classification, and prioritization of malware samples. Use for the first look at any unknown file — hashes, file type, packing, imports, strings, initial IOCs, threat level, and the decision on which deep-analysis phase comes next. Claude runs the static tooling on the host itself; the sample is never executed.
---
# Malware Triage
- Systematic workflow for rapid malware assessment, classification, and prioritization for professional malware analysis and enterprise security operations.
-
- ## When to Use This Skill
-
- Use this skill when the user needs to:
- - Perform initial assessment of malware samples
- - Quickly classify and prioritize samples
- - Identify key indicators without deep analysis
- - Decide whether to proceed with full analysis
- - Triage multiple samples efficiently
- - Create initial findings summary
- - Predict malware behaviors before dynamic analysis
-
- ## Overview
+ First phase for every sample. You run static tools on the host, interpret the output, classify the sample, and decide the next phase. Target: 5-15 minutes per sample.
- Triage is the critical first phase of malware analysis that:
- 1. Quickly identifies key characteristics
- 2. Classifies malware type and threat level
- 3. Determines analysis priority
- 4. Predicts behaviors to guide deeper analysis
- 5. Extracts immediate IOCs
+ ## Execution Model
- **Goal:** Make informed decisions about analysis approach within 5-30 minutes per sample.
+ - **You run the commands.** You have Bash. Execute every command in this skill yourself and interpret the output. Do not ask the user to run tools or paste results unless a tool is missing and cannot be installed.
+ - **Never execute the sample.** Only static tools touch it: `file`, `strings`, `pe_info.py`, `upx -d`, `7z l`, hashing. No `chmod +x`, no `wine`, no `./sample`.
+ - **Never upload the sample** to any service without explicit consent. Hash lookups are fine; file uploads are not.
+ - **Script paths** are relative to this skill directory. From the repo/skill root: `malware-triage/scripts/pe_info.py`, `malware-triage/scripts/hash_calculator.py`, `scripts/ioc_extract.py`. Resolve them from wherever this SKILL.md lives.
+ - **Tool check first.** Run once per session; note what is missing and degrade rather than stop:
+ ```bash
+ command -v file strings upx 7z yara; python3 -c "import pefile" 2>&1 | tail -1
+ # pefile missing -> pip install pefile (needed by pe_info.py)
+ ```
+ - **Big outputs:** never `cat` a strings dump. Save to a file, `wc -l`, then `grep`/`head`.
+ - **Ask the user only for:** the sample path, context (where it came from, incident ID, anything already known), and reputation results if no MCP server is available.
- ## Triage Workflow
+ ## Workflow
- ### Phase 1: Basic Information Gathering (5 minutes)
+ ### Step 1 — Identify and hash
- **Calculate Hashes:**
```bash
- python scripts/hash_calculator.py sample.exe
+ S=/path/to/sample
+ file "$S"; ls -l "$S"
+ python3 malware-triage/scripts/hash_calculator.py "$S"
```
- Document:
- - MD5, SHA1, SHA256
- - Original filename
- - File size
- - File type (PE32/PE64/Script/Document)
-
- **Check Online Reputation:**
- - VirusTotal (virustotal.com)
- - MalwareBazaar (bazaar.abuse.ch)
- - Hybrid Analysis
- - Any.Run
+ Record MD5/SHA1/SHA256, size, `file` output. Then route on the `file` output:
- Record:
- - Detection rate
- - Known family name (if identified)
- - Previous submission dates
- - Community comments
+ | `file` says | Action |
+ |-------------|--------|
+ | `Mono/.Net assembly` | Record hashes, hand back to orchestrator → `specialized-file-analyzer` (check this **before** PE) |
+ | `Microsoft Office`, `PDF document`, `ELF`, `MS Windows shortcut`, `Zip/RAR/7-zip`, `ISO 9660`, `Microsoft Disk Image`, `HTML document`, script/text | Record hashes, hand back to orchestrator → `specialized-file-analyzer` |
+ | `PE32` / `PE32+` (not .NET) | Continue below |
+ | `data` / unrecognized | Continue at **Unknown Files** |
- ### Phase 2: Quick Static Analysis (10 minutes)
+ ### Step 2 — Reputation
- **For PE Files:**
- 1. Check packing/obfuscation
- - Use Detect It Easy (DIE) or PEiD
- - Check entropy (>7.0 = likely packed)
- - Document packer name if identified
+ - **MCP available** (VirusTotal, Threat Intel / MalwareBazaar): look up the SHA256. Record detection ratio, family labels, first-seen date, tags. Look up any imphash and section hashes too.
+ - **No MCP:** give the user the SHA256 and ask them to check VirusTotal / MalwareBazaar while you continue. Do not block on it. Zero detections on a fresh hash means nothing; 0 detections on an old hash is informative.
+ - Reputation is a hint, not the verdict. Static findings override AV labels.
- 2. Examine PE structure
- - Compilation timestamp
- - Section names and characteristics
- - Digital signature status
- - Entry point location
- - Overlay data presence
+ ### Step 3 — PE static summary
- 3. Review import table
- - See `references/indicators.md` for suspicious APIs
- - Note process injection functions
- - Note network functions
- - Note anti-analysis functions
+ ```bash
+ python3 malware-triage/scripts/pe_info.py "$S" # add --json for structured output
+ ```
- 4. Extract strings
- - URLs and IP addresses
- - File paths
- - Registry keys
- - Mutex names
- - Error messages
- - Email addresses
+ Read every section of the output. What matters:
- **For Scripts (PowerShell, VBS, JavaScript):**
- 1. Check obfuscation level
- 2. Look for Base64/hex encoding
- 3. Identify download/execute patterns
- 4. Extract URLs and IPs
- 5. Check for embedded payloads
+ | Output | Interpretation |
+ |--------|----------------|
+ | `.NET: YES` | Stop, route to specialized-file-analyzer |
+ | Compile timestamp in the future / before 2000 | Forged; ignore for dating. Rich header linker info is harder to fake |
+ | Overall entropy > 7.0, or executable section > 6.8, or `!` markers | Packed/encrypted — see **Packed Samples** |
+ | Entry point outside `.text`/`CODE`, or in last section | Packer stub or appended code |
+ | Import count < 10, or only `LoadLibrary`/`GetProcAddress`/`VirtualAlloc` | Runtime API resolution — packed or deliberately hiding imports |
+ | Suspicious import categories (injection, keylogging, network, anti-debug, crypto, persistence) | Map each to a capability; cross-check with `references/indicators.md` |
+ | Overlay present | Appended data: config, second-stage payload, or installer archive. Carve it: `python3 -c "..."` using the reported offset, then `file` the result |
+ | Signature present | Verify claimed signer; revoked/self-signed/mismatched = red flag. Unsigned is neutral |
+ | PDB path | Project/user names, build environment — high-value attribution string |
+ | Resources with high entropy or large size | Embedded payload. Note type/size; extract in deep analysis |
+ | TLS callbacks | Code runs before entry point — anti-debug or early unpacking |
+ | Version info mimicking Microsoft/Adobe/etc. while unsigned | Masquerading |
- **For Office Documents:**
- 1. Check for macros
- 2. Examine OLE streams
- 3. Look for external references
- 4. Check metadata
- 5. Identify exploit indicators
+ ### Step 4 — Strings and IOCs
- ### Packed Sample Handling
+ ```bash
+ W=triage_$(basename "$S") # work dir
+ mkdir -p "$W"
+ strings -a -n 6 "$S" > "$W/strings_ascii.txt"
+ strings -a -n 6 -e l "$S" > "$W/strings_wide.txt" # UTF-16LE, essential for Windows binaries
+ wc -l "$W"/strings_*.txt
+ python3 scripts/ioc_extract.py "$W"/strings_*.txt # defanged IPs, domains, URLs, emails, hashes, reg keys, paths
+ ```
- When a sample is packed or protected, static analysis yields limited results. Identify and document packing before proceeding.
+ Then targeted greps (adjust after reading the ioc_extract output):
- **Identify Packing:**
- - **Entropy analysis** — Overall entropy >7.0 or individual sections with entropy >6.8 strongly indicate packing or encryption
- - **Import table** — Very few imports, or imports limited to `LoadLibrary` / `GetProcAddress` / `VirtualAlloc` / `VirtualProtect` (runtime loading pattern)
- - **Section names** — Known packer section names: `UPX0`, `UPX1`, `UPX2` (UPX); `.themida`, `.winlicence` (Themida/WinLicense); `.vmp0`, `.vmp1` (VMProtect); `.aspack` (ASPack); `.MPRESS1`, `.MPRESS2` (MPRESS)
- - **Section characteristics** — Executable sections with no readable strings, or a single large section combining code and data
- - **PE anomalies** — Entry point outside the first section, missing standard sections (`.text`, `.data`, `.rsrc`), or unusually small code section
+ ```bash
+ grep -ihE 'HKEY_|HKLM|HKCU|CurrentVersion\\Run|schtasks|sc create|netsh|vssadmin|bcdedit|wmic' "$W"/strings_*.txt | sort -u | head -40
+ grep -ihE 'user-agent|mozilla/|POST |GET |Content-Type|\.php|\.onion|/gate|/panel' "$W"/strings_*.txt | sort -u | head -40
+ grep -ihE 'mutex|Global\\|Local\\|\\pipe\\' "$W"/strings_*.txt | sort -u | head -20
+ grep -ihE 'IsDebuggerPresent|VMware|VBox|vbox|QEMU|Xen|sandbox|SbieDll|wireshark|procmon|ollydbg|x64dbg' "$W"/strings_*.txt | sort -u
+ grep -ihE 'bitcoin|monero|\.onion|decrypt|ransom|your files|README' "$W"/strings_*.txt | sort -u | head -20
+ grep -ihE '\.exe|\.dll|\.bat|\.ps1|\.vbs|\.tmp' "$W"/strings_*.txt | grep -viE 'kernel32|ntdll|user32|advapi32|msvcr|api-ms-win' | sort -u | head -40
+ ```
- **Common Packers and Indicators:**
+ Note what is **absent** too: a binary with network imports but no URL/IP strings is decrypting its config at runtime.
- | Packer | Key Indicators | Reversible? |
- |--------|----------------|-------------|
- | **UPX** | `UPX0`/`UPX1` sections, high entropy, `UPX!` magic in overlay | Yes — `upx -d sample.exe` |
- | **Themida / WinLicense** | `.themida` section, virtualized code, anti-debug tricks, large protected section | No — dynamic analysis required |
- | **VMProtect** | `.vmp0`/`.vmp1` sections, custom VM bytecode, heavy anti-tamper | No — dynamic analysis required |
- | **ASPack** | `.aspack` section, low import count, `aSPack` string in binary | Partially — tools available |
- | **MPRESS** | `.MPRESS1`/`.MPRESS2` sections, LZMA compression | Partially — tools available |
- | **Enigma Protector** | `.enigma1`/`.enigma2` sections, license-check stubs | No — dynamic analysis required |
- | **Custom packer** | Unknown section names, high entropy, minimal imports, no recognizable signature | No — dynamic analysis required |
+ Suspicious-API and string categories: `references/indicators.md`.
- **What to Do When Packing is Detected:**
+ ### Packed Samples
- 1. **Document packing in triage findings** — Note the packer name (if identified), entropy values per section, and import count
- 2. **Attempt UPX unpacking if applicable:**
- ```bash
- upx -d packed_sample.exe -o unpacked_sample.exe
- # Verify unpacking succeeded
- python scripts/hash_calculator.py unpacked_sample.exe
- ```
- 3. **Record both packed and unpacked hashes** — The packed hash is the delivery artifact; the unpacked hash may match known malware families
- 4. **Re-run static analysis on the unpacked sample** — Import table and strings will be significantly richer
- 5. **Flag for dynamic analysis** — For non-UPX packers, the sample must unpack itself in a sandbox; document this as the recommended next step
- 6. **Note sophistication level** — Commercial protectors (Themida, VMProtect, Enigma) indicate higher-sophistication threats; custom packers indicate APT-level development
+ Triggered by Step 3 entropy/import findings.
- **Tools for Packer Detection:**
- - **Detect It Easy (DIE)** — Primary tool; identifies 300+ packers and compilers by signature, shows per-section entropy
- - **PEiD** — Signature-based packer detection (older but widely referenced signatures)
- - **pestudio** — PE analysis with packer detection and entropy visualization
- - **ExeinfoPE** — Additional packer signatures, useful when DIE is inconclusive
+ | Packer | Indicators | Unpack on host? |
+ |--------|------------|-----------------|
+ | UPX | `UPX0`/`UPX1` sections, `UPX!` in overlay | Yes: `upx -d "$S" -o "$W/unpacked.exe"` |
+ | Themida / WinLicense | `.themida`, `.winlicense` sections, huge protected section | No — dynamic analysis |
+ | VMProtect | `.vmp0`/`.vmp1` | No — dynamic analysis |
+ | ASPack / MPRESS / Petite / Enigma / Upack | named sections (`.aspack`, `.MPRESS1`, `.petite`, `.enigma1`, `.Upack`) | Rarely — dynamic analysis |
+ | Custom / unknown | high entropy, few imports, no known section names | No — dynamic analysis |
- **Triage Report Updates for Packed Samples:**
- - Set `Packed: Yes - [Packer name or "Unknown packer"]` in the File Information section
- - Add entropy values per section under PE Analysis
- - If unpacked: record unpacked SHA256 and note unpacking method
- - Set Sophistication to at minimum **Moderate** for known packers, **Advanced** for commercial protectors, **Advanced/APT** for custom packers
- - Add "Requires dynamic analysis for full static indicators" to Next Steps if not UPX-unpacked
+ If UPX unpacking succeeds: hash the unpacked file, re-run Steps 3-4 on it, record both hashes (packed = delivery artifact, unpacked = what matches families). If `upx -d` fails, the UPX header was tampered; treat as custom.
- ### Phase 3: Classification (5 minutes)
+ Set sophistication: known packer → at least Moderate; commercial protector → Advanced; custom packer → Advanced/APT. Add "requires dynamic analysis to reveal imports/strings" to next steps.
- **Determine Malware Type:**
- Consult `references/indicators.md` for patterns.
+ ### Step 5 — Classify
- Common types:
- - **Trojan/RAT** - Remote access, C2 communication
- - **Ransomware** - File encryption, ransom demands
- - **Infostealer** - Credential theft, browser data
- - **Dropper/Loader** - Delivers additional payloads
- - **Cryptominer** - Cryptocurrency mining
- - **Backdoor** - Persistent remote access
- - **Worm** - Self-propagating
+ Combine imports, strings, reputation, and context. Consult `references/indicators.md` for the patterns.
- **Assess Threat Level:**
- - **Critical** - Destructive, ransomware, APT
- - **High** - Data theft, full system compromise
- - **Medium** - Limited capabilities, targeted
- - **Low** - Minimal impact, commodity malware
+ | Type | Typical evidence |
+ |------|------------------|
+ | Trojan / RAT / Backdoor | socket or WinHTTP + command dispatch strings, screen/keyboard APIs, persistence |
+ | Ransomware | Crypt* APIs, file enumeration, `vssadmin delete shadows`, ransom-note strings, wallet addresses |
+ | Infostealer | browser profile paths (`Login Data`, `cookies.sqlite`), wallet dirs, `CryptUnprotectData`, exfil URL |
+ | Dropper / Loader | small binary, high-entropy resource or overlay, `URLDownloadToFile`, `WriteFile` + `CreateProcess`, few other capabilities |
+ | Cryptominer | pool URLs (`stratum+tcp://`), `xmrig`, high CPU-related config strings |
+ | Worm | SMB/RPC APIs, network share enumeration, removable-drive checks |
- **Evaluate Sophistication:**
- - **Simple** - Basic functionality, no obfuscation
- - **Moderate** - Some protection, standard techniques
- - **Advanced** - Heavy obfuscation, anti-analysis
- - **APT-level** - Custom, targeted, advanced evasion
+ **Threat level:** Critical (destructive, ransomware, APT) / High (data theft, full compromise) / Medium (limited capability, targeted) / Low (adware, PUP, commodity).
+ **Sophistication:** Simple / Moderate / Advanced / APT-level, driven by protection, evasion, and custom code.
+ **Verdict:** Malicious / Suspicious / Benign. Benign requires positive evidence (valid signature from a plausible vendor, expected imports for its stated purpose, reputation clean over time), not just absence of red flags.
- ### Phase 4: Behavior Prediction (5 minutes)
+ ### Step 6 — Predict behavior
- Based on static indicators, predict:
+ Turn static evidence into a watch list for the dynamic phase. Each prediction names the evidence:
- **Process Activity:**
- - Will it create child processes?
- - Process injection expected?
- - Which processes targeted?
+ - **Process:** child processes or injection expected? Which targets (`CreateRemoteThread` + `OpenProcess` → injection; `CreateProcess` + `cmd`/`powershell` strings → LOLBin chain)?
+ - **Files:** paths from strings; temp/AppData drops if `GetTempPath`/`SHGetFolderPath` imported.
+ - **Registry:** Run keys, service creation, IFEO from strings/imports.
+ - **Network:** protocol (WinHTTP/WinINet → HTTP(S); `socket`/`connect` → raw TCP; `DnsQuery` only → DNS tunnelling/DGA), hard-coded C2 vs runtime-decrypted, likely beacon.
+ - **Persistence:** mechanism and location.
+ - **Evasion:** anti-VM/anti-debug strings → plan for bypass (`malware-dynamic-analysis/references/anti_analysis_bypass.md`).
- **File System:**
- - Files likely to be created (paths)
- - Files likely to be modified
- - Files likely to be deleted
+ These predictions become the Procmon/Sysmon filters and the observation plan for `malware-dynamic-analysis`.
- **Registry:**
- - Persistence keys likely to be used
- - Configuration storage locations
- - System modifications expected
+ ### Step 7 — Priority and next phase
- **Network:**
- - C2 communication expected?
- - Protocol (HTTP/HTTPS/Raw TCP/IRC/DNS)
- - Beacon interval pattern
- - Data exfiltration likely?
+ | Priority | When |
+ |----------|------|
+ | **Immediate** | Unknown/undetected, incident-related, destructive capability, APT indicators, matches current threat intel |
+ | **Standard** | Known family variant, commodity malware with existing coverage |
+ | **Low** | Well-documented sample, adware/PUP, old, likely false positive |
- **Persistence:**
- - Mechanism (Run key/Service/Task/Startup)
- - Location and method
+ Next phase: `malware-dynamic-analysis` for PE files that are packed, have runtime-resolved config, or need behavioral confirmation; `detection-engineer` + `malware-report-writer` directly when the sample is a known variant and static IOCs suffice; `Benign` closes the sample.
- ### Phase 5: Priority and Decision (5 minutes)
+ ## Unknown Files
- **Determine Priority:**
+ `file` returned `data` or something unhelpful:
- **Immediate** (analyze now):
- - Unknown samples unclear threat
- - Active incident-related
- - Destructive capabilities
- - APT/targeted indicators
- - Recent threat intel matches
+ ```bash
+ xxd "$S" | head -20 # magic bytes, structure
+ strings -a -n 8 "$S" | head -50
+ python3 - "$S" <<'EOF' # single-byte XOR brute force for a hidden PE
+ import sys; b=open(sys.argv[1],'rb').read()
+ for k in range(1,256):
+ d=bytes(x^k for x in b[:4096])
+ if d[:2]==b'MZ' or b'This program cannot' in d: print(f"XOR key 0x{k:02x} reveals PE header")
+ EOF
+ ```
- **Standard** (normal queue):
- - Known variant
- - Commodity malware
- - Clear signatures available
- - Historical/research samples
+ Also check: base64 blob (`[A-Za-z0-9+/]{100,}`), gzip/zlib magic (`1f 8b`, `78 9c`), reversed PE (`ZM` at end), shellcode (starts with `fc e8` / `e8 00 00 00 00` / `55 8b ec`). Decode what you find, `file` the result, and re-route.
- **Low** (defer if needed):
- - Clearly identified common malware
- - Adware/PUP minimal impact
- - Old/outdated samples
- - Likely false positives
+ ## Batch Triage
- **Analysis Decision:**
+ For N samples, do a quick pass on all before deep-diving any:
- Proceed with full analysis if:
- - Unknown/new sample
- - Need behavioral confirmation
- - Creating signatures required
- - Investigating specific functionality
+ ```bash
+ for f in samples/*; do
+ echo "== $f"; file "$f"; sha256sum "$f"
+ python3 malware-triage/scripts/pe_info.py "$f" 2>/dev/null | grep -E '^\.NET:|packed|imported functions'
+ done
+ ```
- Quick report if:
- - Known malware with existing docs
- - Time-constrained triage
- - Clear identification from reputation check
+ Produce a ranking table (sample, type, packed, detections, priority, one-line reason), then run the full workflow on Immediate samples first.
- ## Triage Report Template
+ ## Output
- Use this format to document findings:
+ 1. **Print the triage report** (template below, filled in — no placeholders left).
+ 2. **Append to `analysis_state.md`** in the user's working directory using the orchestrator's structure: hashes, type, priority, classification, threat level, triage findings, IOCs (defanged), next-phase recommendation.
+ 3. **Recommend the next phase** with reasoning, then wait for the user.
```markdown
- ## Malware Triage Report
-
- **Sample:** [filename]
- **Date:** [date]
- **Analyst:** [name]
-
- ### File Information
- - **MD5:** [hash]
- - **SHA1:** [hash]
- - **SHA256:** [hash]
- - **Size:** [bytes]
- - **Type:** [PE32/PE64/Script/etc]
- - **Packed:** [Yes/No - Packer name]
-
- ### Online Reputation
- - **VirusTotal:** [XX/YY detections - Link]
- - **Known Family:** [Family name or Unknown]
- - **First Seen:** [Date or Unknown]
-
- ### Static Indicators
-
- **PE Analysis:**
- - Compilation Date: [date]
- - Digital Signature: [Valid/Invalid/None]
- - Sections: [names and entropy]
- - Entry Point: [location]
+ ## Triage Report — [filename]
- **Suspicious Imports:**
- - [DLL]: [Function, Function, ...]
- - [Key: Process injection, Network, Anti-analysis]
+ **Hashes:** MD5 … / SHA1 … / SHA256 … **Size:** … bytes **Type:** … **Packed:** No | Yes (packer)
+ **Reputation:** VT x/y, family label(s), first seen … | not checked
- **Notable Strings:**
- - URLs: [list]
- - IPs: [list]
- - Paths: [list]
- - Registry: [list]
- - Mutex: [name if found]
+ ### Static Findings
+ - Compile time / linker / signature / PDB
+ - Sections + entropy (flag anomalies)
+ - Suspicious imports by category → capability
+ - Notable strings: URLs, IPs, paths, registry, mutex, UA, commands
+ - Resources / overlay / TLS callbacks
### Classification
-
- **Type:** [Trojan/Ransomware/Infostealer/etc]
- **Threat Level:** [Critical/High/Medium/Low]
- **Sophistication:** [Simple/Moderate/Advanced/APT]
-
- **Primary Capabilities:**
- - [Capability 1]
- - [Capability 2]
- - [Capability 3]
-
- ### Predicted Behaviors
-
- **Process Activity:**
- - [Expected behavior]
-
- **File System:**
- - [Expected modifications]
-
- **Registry:**
- - [Expected changes]
-
- **Network:**
- - [Expected communication]
-
- **Persistence:**
- - [Expected mechanism]
-
- ### Initial IOCs
-
- **File Indicators:**
- - Hashes listed above
- - [Additional file indicators]
+ **Verdict:** Malicious | Suspicious | Benign **Type:** … **Threat:** Critical | High | Medium | Low **Sophistication:** …
+ **Capabilities:** …
- **Network Indicators:**
- - [IPs from strings]
- - [Domains from strings]
+ ### Predicted Behavior
+ Process / Files / Registry / Network / Persistence / Evasion — each with the evidence behind it
- **Host Indicators:**
- - [Registry keys]
- - [File paths]
- - [Mutex names]
+ ### Initial IOCs (defanged)
+ File: hashes, imphash, dropped names · Network: … · Host: registry, paths, mutex
### Recommendation
-
- **Priority:** [Immediate/Standard/Low]
-
- **Next Steps:**
- 1. [Action 1 - e.g., Proceed with full dynamic analysis]
- 2. [Action 2 - e.g., Create YARA rule]
- 3. [Action 3 - e.g., Search network for IOCs]
-
- **Analysis Approach:**
- [Full analysis / Behavioral confirmation / Quick signature creation]
-
- **Estimated Time:** [time estimate for full analysis]
- ```
-
- ## Time Management
-
- ### Professional Analysis Context
- When analyzing multiple samples, efficient triage is critical:
-
- **Quick Triage (5 min/sample):**
- - Hashes + VirusTotal
- - Basic file info
- - Quick priority decision
-
- **Standard Triage (15 min/sample):**
- - Above + imports analysis
- - String extraction
- - Classification
- - Behavior prediction
-
- **Comprehensive Triage (30 min/sample):**
- - Above + detailed documentation
- - Initial IOC list
- - Full prediction writeup
- - YARA concept notes
-
- **Strategy:**
- - Quick triage ALL samples first
- - Prioritize based on findings
- - Comprehensive triage high-priority samples
- - Defer or quick-report low-priority samples
-
- ## Key References
-
- ### Suspicious Indicators
- See `references/indicators.md` for comprehensive lists of:
- - Suspicious API imports by category
- - Common string patterns
- - Behavioral indicators
- - Packer signatures
- - Red flags by file type
- - Quick classification patterns
-
- ### Detailed Checklist
- See `references/triage_checklist.md` for:
- - Complete step-by-step checklist
- - Decision tree guidance
- - Dynamic analysis go/no-go criteria
- - Common pitfalls to avoid
- - Tools quick reference
-
- ## Tools and Scripts
-
- ### Hash Calculator
- ```bash
- # Run from the malware-triage/ directory:
- python scripts/hash_calculator.py <sample_path>
-
- # Or from the repo root:
- python malware-triage/scripts/hash_calculator.py <sample_path>
+ **Priority:** … **Next phase:** … **Why:** …
```
- Quickly calculates all three hashes (MD5, SHA1, SHA256) for documentation.
- ### Recommended External Tools
-
- **Static Analysis:**
- - Detect It Easy (DIE) - Packer detection
- - PEStudio - PE analysis
- - strings / FLOSS - String extraction
- - HxD - Hex editor
- - CFF Explorer - PE structure
-
- **Online Services:**
- - VirusTotal - Multi-engine scanning
- - MalwareBazaar - Sample database
- - Hybrid Analysis - Automated analysis
- - Any.Run - Interactive sandbox
-
- ## Best Practices
-
- ### Do:
- - Always calculate all three hashes immediately
- - Check multiple reputation sources
- - Document findings as you discover them
- - Use checklists to ensure completeness
- - Consider false positive possibilities
- - Predict behaviors before dynamic analysis
- - Prioritize samples logically
-
- ### Don't:
- - Skip basic file information
- - Rely solely on VirusTotal results
- - Assume packing means malicious
- - Execute without proper isolation
- - Trust timestamps (easily forged)
- - Ignore negative findings
- - Rush classification decisions
-
- ### Efficiency Tips:
- 1. Have tools ready and scripts prepared
- 2. Use templates for documentation
- 3. Automate hash calculation
- 4. Keep a reference of common indicators
- 5. Build up a personal knowledge base
- 6. Take notes during, not after
- 7. Use multiple monitors if possible
-
- ## Common Triage Scenarios
-
- ### Scenario 1: Unknown Executable
- 1. Calculate hashes → not found online
- 2. Check packing → heavily packed
- 3. Review imports → suspicious injection/network APIs
- 4. Classification → likely trojan/RAT
- 5. Decision → Full analysis required
-
- ### Scenario 2: Suspicious Document
- 1. Calculate hashes → 0 detections
- 2. Check macros → obfuscated VBA
- 3. Extract strings → download URLs found
- 4. Classification → dropper via macro
- 5. Decision → Dynamic analysis of macro behavior
-
- ### Scenario 3: Known Malware Variant
- 1. Calculate hashes → 50+ detections, identified as Emotet
- 2. Review VirusTotal → well-documented
- 3. Quick checks → confirms expected indicators
- 4. Classification → confirmed Emotet variant
- 5. Decision → Quick report, no deep analysis needed
-
- ## Integration with Full Analysis
-
- Triage findings guide the full analysis:
-
- **Use predictions to:**
- - Know what to monitor during dynamic analysis
- - Set up appropriate monitoring tools
- - Focus on predicted areas first
- - Validate or refute hypotheses
-
- **Triage report becomes:**
- - Introduction section of full report
- - Hypothesis to test during analysis
- - Quick reference during investigation
- - Foundation for IOC development
-
- ## Quality Checklist
-
- Before concluding triage:
- - [ ] All three hashes calculated and verified
- - [ ] Online reputation checked (at least VirusTotal)
- - [ ] File type and basic info documented
- - [ ] Packing status determined
- - [ ] Key imports identified
- - [ ] Notable strings extracted
- - [ ] Classification assigned with reasoning
- - [ ] Threat level assessed
- - [ ] Behaviors predicted
- - [ ] Priority determined
- - [ ] Next steps documented
- - [ ] Initial IOCs listed
- - [ ] Findings clearly documented
+ ## Quality Gate
- ## Example Usage
+ Before handing back: all three hashes; `file` type; packing status with evidence; imports categorized; strings run in both ASCII and UTF-16; IOCs extracted and defanged; classification with reasoning; predictions tied to evidence; state file updated.
- **User request:** "I have a suspicious .exe file, help me triage it"
+ ## References
- **Workflow:**
- 1. Guide user to calculate hashes
- 2. Check online reputation together
- 3. Examine PE structure and imports
- 4. Extract and review strings
- 5. Classify based on indicators
- 6. Predict behaviors
- 7. Recommend next steps
- 8. Create triage report
+ - `references/indicators.md` — suspicious API imports, string patterns, behavioral indicators, packer signatures, classification patterns
+ - `references/triage_checklist.md` — full checklist, decision tree, dynamic go/no-go criteria, tool reference
+ - `scripts/pe_info.py` — PE header/section/import/resource/overlay/signature summary (needs `pefile`)
+ - `scripts/hash_calculator.py` — MD5/SHA1/SHA256
+ - `../scripts/ioc_extract.py` — IOC extraction and defanging from any text