Malware Analysis

When to Activate

• Analyzing suspicious binaries or scripts
• Writing detection signatures (YARA, Snort, Sigma)
• Understanding malware capabilities and C2 protocols
• Unpacking protected/obfuscated samples
• Incident response — determining scope of compromise
• Threat intelligence — attributing samples to threat actors

Static Analysis

Initial Triage

# File identification
file sample.exe
sha256sum sample.exe
ssdeep sample.exe  # fuzzy hash for similarity