Malware Triage

Analyze suspicious samples safely and extract actionable indicators fast.

Safety First

• Isolated VM or dedicated sandbox (Cuckoo/ANY.RUN/vendor sandbox), network simulated or sinkholed
• Samples stored in password-protected archives, hash-named; never opened on analysis-adjacent hosts
• Work from snapshots; revert after every detonation

1. Static Triage

• Hashes (MD5/SHA256), file type, entropy (file, pestudio-style overview)
• Strings: URLs, mutexes, registry paths, PDB paths, C2 patterns
• PE specifics: imports of interest (network, process injection, crypto APIs), digital signature validity, packer detection (entropy + section names)
• Document metadata (Office macros, embedded objects, remote templates)

2. Dynamic Detonation