Malware triage

When it applies

You have a sample (a dropped binary, a macro-laden document, a suspicious script) or a live process and need a fast verdict plus IOCs — not full reverse engineering, but enough to decide and to feed detection/IR.

Why it works

Most samples reveal their nature cheaply: capabilities, embedded strings, and behaviour appear long before you need a disassembler. Triage front-loads the cheap signals and only escalates to deep RE when the verdict is still unclear — so you get IOCs fast without burning hours per file.

Method

1. Handle safely: work in an isolated VM/network, never on a production host. Treat the sample as live; don't double-click to "see what it does" outside a sandbox.
2. Identify: hashes, file type (magic bytes, not extension), and a reputation check by hash (not by uploading the file if it may be sensitive/targeted).
3. Static, no execution: capa for capabilities (persistence, injection, C2), FLOSS/strings for URLs, IPs, mutexes, registry keys; for Office/PDF, extract and de-obfuscate the macro/JS (olevba, CyberChef). PE: imports, sections, signing, compile time (pestudio).
4. Dynamic, if needed: detonate in a sandbox; capture process tree, file/registry writes, network. This confirms behaviour static analysis only hinted at.
5. Extract IOCs & a rule: host IOCs (paths, mutexes, keys) and network IOCs (C2 domains/IPs); write a YARA rule on stable internals (not a rotating hash) for hunting.
6. Feed the pipeline: hand behavioural IOCs to defense-threat-hunting and turn stable ones into a detection; if it's live on a host, escalate to defense-incident-response. Deep dive → reverse-eng-*.

Gotchas

• Uploading a targeted sample to a public multiscanner can tip off the adversary — hash-check first.
• Malware detects sandboxes (sleeps, VM checks) and stays dormant — a clean dynamic run isn't clearance; weigh the static capabilities too.
• Hash-based rules rot instantly; write YARA on code/string internals that survive rebuilds.

Verify success

You have a supported verdict (malicious/suspicious/benign), a capability summary, host + network IOCs, and a YARA/detection rule — enough to hunt for other affected hosts.

References

Mandiant/FLARE capa & FLOSS; YARA; pestudio; olevba (oletools); MITRE ATT&CK.