malware-triage-workflow

name	malware-triage-workflow
description	Triage suspicious binaries by combining static indicators, control-flow hints, YARA or pattern matches, and debugger confirmation. Use when the sample may be malicious, packed, evasive, or operationally risky.
aliases	["malware-triage","suspicious-binary-triage","malware-analysis-workflow"]
category	Developer Tools
tags	["reverse-engineering","malware-analysis","yara","debugger","ghidra","binary-triage"]
version	1.0.0
resolutionHints	["triage malware sample","analyze suspicious binary","combine static and dynamic malware evidence"]
metadata	{"source":"evokore","derived_from":["binary-mcp","ghidra-headless-mcp","x64dbg","malcontent","oletools"]}

Malware Triage Workflow

Run a behavior-first triage that quickly answers what the sample touches, how risky it looks, and which routines deserve deep reverse engineering.

Workflow

1. Collect static indicators first:
   • format, architecture, packer or entropy clues
   • imports, exports, strings, sections, resources
   • suspicious APIs and network / filesystem / registry markers
   • YARA or family-pattern matches if available
2. Identify high-risk behavior buckets:
   • persistence
   • credential access
   • command and control
   • injection / hollowing
   • crypto / ransomware behavior
   • anti-analysis / sandbox checks
3. Select a small set of target functions for deeper decompilation.
4. Use debugger confirmation only for the riskiest unknowns:
   • decoded config
   • runtime-resolved imports
   • dropped paths
   • beacon construction
   • key material or encryption flow
5. Produce a short operator report before moving into full family-level RE.

Tool Families to Prefer

• binary_analysis_*triage*
• binary_analysis_*malware*
• binary_analysis_*yara*
• binary_analysis_*control*
• binary_analysis_*report*
• ghidra_headless_search.*
• ghidra_headless_reference.*
• ghidra_headless_decomp.function

Output Structure

1. Sample identity and format summary
2. Top suspicious indicators
3. Likely behavior categories
4. Priority functions / addresses for deeper RE
5. Dynamic checks still required
6. Confidence level and major unknowns