--- name: malware-triage description: Perform static analysis and triage of suspicious files. Extract hashes, strings, metadata, PE headers, ELF info, embedded URLs, and indicators using strings, file, exiftool, readelf, objdump, radare2, and binwalk. argument-hint: allowed-tools: Bash Read Write Grep Glob --- # Malware Triage & Static Analysis You are performing static malware analysis on a suspicious file. Extract indicators, analyze structure, and assess threat level WITHOUT executing the file. **SAFETY**: Do NOT execute, run, or invoke the suspicious file. Static analysis only. ## Target Suspicious file: `$ARGUMENTS` ## Pre-flight Checks ```! which strings file exiftool sha256sum md5sum 2>/dev/null || echo "WARNING: basic tools missing" which readelf objdump r2 2>/dev/null || echo "WARNING: binary analysis tools missing" which binwalk 2>/dev/null || echo "WARNING: binwalk not found" ``` ## Analysis Procedure ### Phase 1: File Identification ```bash # Basic file type file # MIME type file --mime-type # File size ls -lh # Cryptographic hashes sha256sum md5sum sha1sum # Fuzzy hash (if ssdeep available) ssdeep 2>/dev/null || echo "ssdeep not available" ``` ### Phase 2: Metadata Extraction ```bash # Full EXIF/metadata exiftool ``` Look for: - Compilation timestamps - Original filename vs current filename mismatches - Author/company metadata (can indicate legitimacy or origin) - Suspicious tools in metadata (e.g., packed with UPX, Themida) ### Phase 3: String Analysis ```bash # ASCII strings (minimum length 6) strings -a -n 6 > /tmp/strings_output.txt wc -l /tmp/strings_output.txt # Unicode/wide strings strings -a -n 6 -el >> /tmp/strings_output.txt # Suspicious string categories echo "=== URLs and IPs ===" grep -oiE "https?://[^ \"'>]+" /tmp/strings_output.txt | sort -u grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}(:[0-9]+)?" /tmp/strings_output.txt | sort -u echo "=== Registry keys ===" grep -i "HKEY_\|\\\\Software\\\\\|\\\\CurrentVersion\\\\" /tmp/strings_output.txt | sort -u | head -20 echo "=== File paths ===" grep -iE "([A-Z]:\\\\|/tmp/|/var/|/etc/|%APPDATA%|%TEMP%)" /tmp/strings_output.txt | sort -u | head -20 echo "=== Suspicious API calls ===" grep -iE "(VirtualAlloc|VirtualProtect|CreateRemoteThread|WriteProcessMemory|NtUnmapViewOfSection|LoadLibrary|GetProcAddress|WinExec|ShellExecute|CreateProcess|URLDownloadToFile|InternetOpen|HttpSendRequest|WSAStartup|connect|bind|listen|accept|recv|send|socket)" /tmp/strings_output.txt | sort -u | head -30 echo "=== Crypto/encoding indicators ===" grep -iE "(AES|RSA|base64|crypt|encode|decode|cipher|BEGIN.*KEY|BEGIN.*CERTIFICATE)" /tmp/strings_output.txt | sort -u | head -20 echo "=== Anti-analysis indicators ===" grep -iE "(IsDebuggerPresent|CheckRemoteDebugger|NtQueryInformationProcess|OutputDebugString|vmware|virtualbox|vbox|sandbox|wine_get)" /tmp/strings_output.txt | sort -u | head -20 echo "=== Persistence keywords ===" grep -iE "(schtasks|at |reg add|netsh|sc create|wmic|startup|autorun|crontab|systemctl|init\.d)" /tmp/strings_output.txt | sort -u | head -20 echo "=== Credential/data theft keywords ===" grep -iE "(password|passwd|credential|login|cookie|wallet|bitcoin|keylog|clipboard|screenshot)" /tmp/strings_output.txt | sort -u | head -20 ``` ### Phase 4: Binary Structure Analysis #### For PE files (Windows executables): ```bash # PE header info via objdump objdump -x 2>/dev/null | head -80 # Sections (look for unusual names, high entropy, or executable data sections) objdump -h 2>/dev/null # Imports objdump -p 2>/dev/null | grep -A1000 "Import Tables" | head -100 # Check for packing indicators strings -a | grep -iE "(UPX|Themida|VMProtect|Enigma|Armadillo|ASPack|PECompact)" | head -10 ``` #### For ELF files (Linux executables): ```bash # ELF header readelf -h 2>/dev/null # Section headers (look for unusual sections) readelf -S 2>/dev/null # Program headers readelf -l 2>/dev/null # Dynamic section (shared libraries, RPATH) readelf -d 2>/dev/null # Symbol table readelf -s 2>/dev/null | head -50 # Check if stripped file | grep -i "stripped" ``` #### For scripts (Python, PowerShell, Bash, JS): ```bash # Detect obfuscation head -50 # Look for encoded payloads grep -oE "[A-Za-z0-9+/=]{50,}" | head -10 # Try to decode base64 blobs grep -oE "[A-Za-z0-9+/=]{50,}" | head -5 | while read line; do echo "$line" | base64 -d 2>/dev/null | strings -n 6 | head -5; echo "---"; done ``` ### Phase 5: Embedded Content Detection ```bash # Scan for embedded files binwalk -B # Entropy analysis (high entropy = encrypted/compressed/packed) binwalk -E 2>/dev/null ``` ### Phase 6: Radare2 Quick Analysis (if available) ```bash # Quick binary info r2 -q -c "i" 2>/dev/null # List functions r2 -q -c "aa; afl" 2>/dev/null | head -30 # Entry point disassembly r2 -q -c "aa; s entry0; pd 20" 2>/dev/null # Cross-references to suspicious imports r2 -q -c "aa; axt @ sym.imp.VirtualAlloc" 2>/dev/null r2 -q -c "aa; axt @ sym.imp.CreateRemoteThread" 2>/dev/null ``` ### Phase 7: YARA Scanning (if available) ```bash # If yara is installed, scan with common rules yara -r /path/to/rules 2>/dev/null || echo "yara not available or no rules provided" # Python yara module alternative python3 -c " import yara # Basic packer/crypto detection rules inline rules = yara.compile(source=''' rule upx_packed { strings: \$upx = \"UPX!\" condition: \$upx } rule base64_payload { strings: \$b64 = /[A-Za-z0-9+\/=]{100,}/ condition: \$b64 } rule suspicious_pe { strings: \$mz = \"MZ\" at 0 \$api1 = \"VirtualAlloc\" \$api2 = \"CreateRemoteThread\" condition: \$mz and (\$api1 or \$api2) } ''') matches = rules.match(sys.argv[1]) for m in matches: print(f'YARA match: {m.rule}') " 2>/dev/null || echo "python3-yara not available" ``` ## Threat Assessment Criteria Rate the file based on accumulated indicators: | Indicator | Weight | |-----------|--------| | Suspicious API imports (injection, process manipulation) | High | | Network-related strings (URLs, IPs, C2 patterns) | High | | Anti-analysis/evasion techniques | High | | Packed/encrypted sections | Medium | | Persistence mechanisms in strings | Medium | | Credential theft keywords | Medium | | Unusual metadata (fake timestamps, mismatched names) | Low | | High entropy sections | Low (supports other findings) | ## Validation Rules 1. **String hits**: A suspicious string alone is not proof — correlate with imports, behavior, and context 2. **Packing**: Confirmed by both high entropy AND packer signatures/section names 3. **Malicious intent**: Requires MULTIPLE indicators (e.g., injection APIs + network strings + anti-debug) 4. **False positive check**: Is this a legitimate tool (e.g., Metasploit, nmap) rather than actual malware? ## Report Output Write the report to `./reports/malware-triage-report.md`: ```markdown # Malware Triage Report **Date**: **File**: **SHA256**: **MD5**: **File Type**: **File Size**: **Analyst**: Claude Code DFIR ## Executive Summary ## Threat Level: [CRITICAL / HIGH / MEDIUM / LOW / BENIGN] ## File Properties | Property | Value | |----------|-------| | Type | | | Size | | | SHA256 | | | MD5 | | | Compiled | | | Packer | | ## Findings ### Finding 1: - **Category**: Injection / Evasion / Persistence / C2 / Credential Theft / Other - **Evidence**: <specific data> - **Validation**: <how confirmed> - **MITRE ATT&CK**: <technique ID> - **Reproduce**: ```bash <exact command(s) the analyst can copy-paste to independently verify this finding> ``` ## Indicators of Compromise | Type | Value | Context | |------|-------|---------| | SHA256 | | | | MD5 | | | | URL | | | | IP | | | | Domain | | | | Mutex | | | | Registry | | | ## Suspicious Strings (Curated) <Top 20 most relevant strings with context> ## Recommendations <Numbered response actions> ``` Create the `reports/` directory if it does not exist.