---

name: malware-triage description: Perform static analysis and triage of suspicious files. Extract hashes, strings, metadata, PE headers, ELF info, embedded URLs, and indicators using strings, file, exiftool, readelf, objdump, radare2, and binwalk. argument-hint: <path-to-suspicious-file> allowed-tools: Bash Read Write Grep Glob

Malware Triage & Static Analysis

You are performing static malware analysis on a suspicious file. Extract indicators, analyze structure, and assess threat level WITHOUT executing the file.

SAFETY: Do NOT execute, run, or invoke the suspicious file. Static analysis only.

Target

Suspicious file: $ARGUMENTS

Pre-flight Checks

which strings file exiftool sha256sum md5sum 2>/dev/null || echo "WARNING: basic tools missing"
which readelf objdump r2 2>/dev/null || echo "WARNING: binary analysis tools missing"
which binwalk 2>/dev/null || echo "WARNING: binwalk not found"

Analysis Procedure

Phase 1: File Identification

# Basic file type
file <target>

# MIME type
file --mime-type <target>

# File size
ls -lh <target>

# Cryptographic hashes
sha256sum <target>
md5sum <target>
sha1sum <target>

# Fuzzy hash (if ssdeep available)
ssdeep <target> 2>/dev/null || echo "ssdeep not available"

Phase 2: Metadata Extraction

# Full EXIF/metadata
exiftool <target>

Look for:

• Compilation timestamps
• Original filename vs current filename mismatches
• Author/company metadata (can indicate legitimacy or origin)
• Suspicious tools in metadata (e.g., packed with UPX, Themida)

Phase 3: String Analysis

# ASCII strings (minimum length 6)
strings -a -n 6 <target> > /tmp/strings_output.txt
wc -l /tmp/strings_output.txt

# Unicode/wide strings
strings -a -n 6 -el <target> >> /tmp/strings_output.txt

# Suspicious string categories
echo "=== URLs and IPs ==="
grep -oiE "https?://[^ \"'>]+" /tmp/strings_output.txt | sort -u
grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}(:[0-9]+)?" /tmp/strings_output.txt | sort -u

echo "=== Registry keys ==="
grep -i "HKEY_\|\\\\Software\\\\\|\\\\CurrentVersion\\\\" /tmp/strings_output.txt | sort -u | head -20

echo "=== File paths ==="
grep -iE "([A-Z]:\\\\|/tmp/|/var/|/etc/|%APPDATA%|%TEMP%)" /tmp/strings_output.txt | sort -u | head -20

echo "=== Suspicious API calls ==="
grep -iE "(VirtualAlloc|VirtualProtect|CreateRemoteThread|WriteProcessMemory|NtUnmapViewOfSection|LoadLibrary|GetProcAddress|WinExec|ShellExecute|CreateProcess|URLDownloadToFile|InternetOpen|HttpSendRequest|WSAStartup|connect|bind|listen|accept|recv|send|socket)" /tmp/strings_output.txt | sort -u | head -30

echo "=== Crypto/encoding indicators ==="
grep -iE "(AES|RSA|base64|crypt|encode|decode|cipher|BEGIN.*KEY|BEGIN.*CERTIFICATE)" /tmp/strings_output.txt | sort -u | head -20

echo "=== Anti-analysis indicators ==="
grep -iE "(IsDebuggerPresent|CheckRemoteDebugger|NtQueryInformationProcess|OutputDebugString|vmware|virtualbox|vbox|sandbox|wine_get)" /tmp/strings_output.txt | sort -u | head -20

echo "=== Persistence keywords ==="
grep -iE "(schtasks|at |reg add|netsh|sc create|wmic|startup|autorun|crontab|systemctl|init\.d)" /tmp/strings_output.txt | sort -u | head -20

echo "=== Credential/data theft keywords ==="
grep -iE "(password|passwd|credential|login|cookie|wallet|bitcoin|keylog|clipboard|screenshot)" /tmp/strings_output.txt | sort -u | head -20

Phase 4: Binary Structure Analysis

For PE files (Windows executables):

# PE header info via objdump
objdump -x <target> 2>/dev/null | head -80

# Sections (look for unusual names, high entropy, or executable data sections)
objdump -h <target> 2>/dev/null

# Imports
objdump -p <target> 2>/dev/null | grep -A1000 "Import Tables" | head -100

# Check for packing indicators
strings -a <target> | grep -iE "(UPX|Themida|VMProtect|Enigma|Armadillo|ASPack|PECompact)" | head -10

For ELF files (Linux executables):

# ELF header
readelf -h <target> 2>/dev/null

# Section headers (look for unusual sections)
readelf -S <target> 2>/dev/null

# Program headers
readelf -l <target> 2>/dev/null

# Dynamic section (shared libraries, RPATH)
readelf -d <target> 2>/dev/null

# Symbol table
readelf -s <target> 2>/dev/null | head -50

# Check if stripped
file <target> | grep -i "stripped"

For scripts (Python, PowerShell, Bash, JS):

# Detect obfuscation
head -50 <target>

# Look for encoded payloads
grep -oE "[A-Za-z0-9+/=]{50,}" <target> | head -10
# Try to decode base64 blobs
grep -oE "[A-Za-z0-9+/=]{50,}" <target> | head -5 | while read line; do echo "$line" | base64 -d 2>/dev/null | strings -n 6 | head -5; echo "---"; done

Phase 5: Embedded Content Detection

# Scan for embedded files
binwalk -B <target>

# Entropy analysis (high entropy = encrypted/compressed/packed)
binwalk -E <target> 2>/dev/null

Phase 6: Radare2 Quick Analysis (if available)

# Quick binary info
r2 -q -c "i" <target> 2>/dev/null

# List functions
r2 -q -c "aa; afl" <target> 2>/dev/null | head -30

# Entry point disassembly
r2 -q -c "aa; s entry0; pd 20" <target> 2>/dev/null

# Cross-references to suspicious imports
r2 -q -c "aa; axt @ sym.imp.VirtualAlloc" <target> 2>/dev/null
r2 -q -c "aa; axt @ sym.imp.CreateRemoteThread" <target> 2>/dev/null

Phase 7: YARA Scanning (if available)

# If yara is installed, scan with common rules
yara -r /path/to/rules <target> 2>/dev/null || echo "yara not available or no rules provided"

# Python yara module alternative
python3 -c "
import yara
# Basic packer/crypto detection rules inline
rules = yara.compile(source='''
rule upx_packed { strings: \$upx = \"UPX!\" condition: \$upx }
rule base64_payload { strings: \$b64 = /[A-Za-z0-9+\/=]{100,}/ condition: \$b64 }
rule suspicious_pe { strings: \$mz = \"MZ\" at 0 \$api1 = \"VirtualAlloc\" \$api2 = \"CreateRemoteThread\" condition: \$mz and (\$api1 or \$api2) }
''')
matches = rules.match(sys.argv[1])
for m in matches: print(f'YARA match: {m.rule}')
" <target> 2>/dev/null || echo "python3-yara not available"

Threat Assessment Criteria

Rate the file based on accumulated indicators:

| Indicator | Weight | |-----------|--------| | Suspicious API imports (injection, process manipulation) | High | | Network-related strings (URLs, IPs, C2 patterns) | High | | Anti-analysis/evasion techniques | High | | Packed/encrypted sections | Medium | | Persistence mechanisms in strings | Medium | | Credential theft keywords | Medium | | Unusual metadata (fake timestamps, mismatched names) | Low | | High entropy sections | Low (supports other findings) |

Validation Rules

1. String hits: A suspicious string alone is not proof — correlate with imports, behavior, and context
2. Packing: Confirmed by both high entropy AND packer signatures/section names
3. Malicious intent: Requires MULTIPLE indicators (e.g., injection APIs + network strings + anti-debug)
4. False positive check: Is this a legitimate tool (e.g., Metasploit, nmap) rather than actual malware?

Report Output

Write the report to ./reports/malware-triage-report.md:

# Malware Triage Report

**Date**: <date>
**File**: <filename>
**SHA256**: <hash>
**MD5**: <hash>
**File Type**: <type>
**File Size**: <size>
**Analyst**: Claude Code DFIR

## Executive Summary
<Threat assessment in 2-3 sentences>

## Threat Level: [CRITICAL / HIGH / MEDIUM / LOW / BENIGN]

## File Properties
| Property | Value |
|----------|-------|
| Type     |       |
| Size     |       |
| SHA256   |       |
| MD5      |       |
| Compiled |       |
| Packer   |       |

## Findings

### Finding 1: <Title>
- **Category**: Injection / Evasion / Persistence / C2 / Credential Theft / Other
- **Evidence**: <specific data>
- **Validation**: <how confirmed>
- **MITRE ATT&CK**: <technique ID>
- **Reproduce**:
  ```bash
  <exact command(s) the analyst can copy-paste to independently verify this finding>

Indicators of Compromise

| Type | Value | Context | |------|-------|---------| | SHA256 | | | | MD5 | | | | URL | | | | IP | | | | Domain | | | | Mutex | | | | Registry | | |

Suspicious Strings (Curated)

<Top 20 most relevant strings with context>

Recommendations

<Numbered response actions> ```

Create the reports/ directory if it does not exist.