malware-triage

name	malware-triage
description	Perform static analysis and triage of suspicious files. Extract hashes, strings, metadata, PE headers, ELF info, embedded URLs, and indicators using strings, file, exiftool, readelf, objdump, radare2, and binwalk.
argument-hint	<path-to-suspicious-file>
allowed-tools	Bash Read Write Grep Glob

Malware Triage & Static Analysis

You are performing static malware analysis on a suspicious file. Extract indicators, analyze structure, and assess threat level WITHOUT executing the file.

SAFETY: Do NOT execute, run, or invoke the suspicious file. Static analysis only.

Target

Suspicious file: $ARGUMENTS

Pre-flight Checks

which strings file exiftool sha256sum md5sum 2>/dev/null || echo "WARNING: basic tools missing"
which readelf objdump r2 2>/dev/null || echo "WARNING: binary analysis tools missing"
which binwalk 2>/dev/null || echo "WARNING: binwalk not found"

Analysis Procedure

Phase 1: File Identification

# Basic file type
file <target>

# MIME type
file --mime-type <target>

# File size
ls -lh <target>

# Cryptographic hashes
sha256sum <target>
md5sum <target>
sha1sum <target>

# Fuzzy hash (if ssdeep available)
ssdeep <target> 2>/dev/null || echo "ssdeep not available"

Phase 2: Metadata Extraction

# Full EXIF/metadata
exiftool <target>

Look for:

• Compilation timestamps
• Original filename vs current filename mismatches
• Author/company metadata (can indicate legitimacy or origin)
• Suspicious tools in metadata (e.g., packed with UPX, Themida)

Phase 3: String Analysis

# ASCII strings (minimum length 6)
strings -a -n 6 <target> > /tmp/strings_output.txt
wc -l /tmp/strings_output.txt

# Unicode/wide strings
strings -a -n 6 -el <target> >> /tmp/strings_output.txt

# Suspicious string categories
echo "=== URLs and IPs ==="
grep -oiE "https?://[^ \"'>]+" /tmp/strings_output.txt | sort -u
grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}(:[0-9]+)?" /tmp/strings_output.txt | sort -u

echo "=== Registry keys ==="
grep -i "HKEY_\|\\\\Software\\\\\|\\\\CurrentVersion\\\\" /tmp/strings_output.txt | sort -u | head -20

echo "=== File paths ==="
grep -iE "([A-Z]:\\\\|/tmp/|/var/|/etc/|%APPDATA%|%TEMP%)" /tmp/strings_output.txt | sort -u | head -20

echo "=== Suspicious API calls ==="
grep -iE "(VirtualAlloc|VirtualProtect|CreateRemoteThread|WriteProcessMemory|NtUnmapViewOfSection|LoadLibrary|GetProcAddress|WinExec|ShellExecute|CreateProcess|URLDownloadToFile|InternetOpen|HttpSendRequest|WSAStartup|connect|bind|listen|accept|recv|send|socket)" /tmp/strings_output.txt | sort -u | head -30

echo "=== Crypto/encoding indicators ==="
grep -iE "(AES|RSA|base64|crypt|encode|decode|cipher|BEGIN.*KEY|BEGIN.*CERTIFICATE)" /tmp/strings_output.txt | sort -u | head -20

echo "=== Anti-analysis indicators ==="
grep -iE "(IsDebuggerPresent|CheckRemoteDebugger|NtQueryInformationProcess|OutputDebugString|vmware|virtualbox|vbox|sandbox|wine_get)" /tmp/strings_output.txt | sort -u | head -20

echo "=== Persistence keywords ==="
grep -iE "(schtasks|at |reg add|netsh|sc create|wmic|startup|autorun|crontab|systemctl|init\.d)" /tmp/strings_output.txt | sort -u | head -20

echo "=== Credential/data theft keywords ==="
grep -iE "(password|passwd|credential|login|cookie|wallet|bitcoin|keylog|clipboard|screenshot)" /tmp/strings_output.txt | sort -u | head -20

Phase 4: Binary Structure Analysis

For PE files (Windows executables):

# PE header info via objdump
objdump -x <target> 2>/dev/null | head -80

# Sections (look for unusual names, high entropy, or executable data sections)
objdump -h <target> 2>/dev/null

# Imports
objdump -p <target> 2>/dev/null | grep -A1000 "Import Tables" | head -100

# Check for packing indicators
strings -a <target> | grep -iE "(UPX|Themida|VMProtect|Enigma|Armadillo|ASPack|PECompact)" | head -10

For ELF files (Linux executables):

# ELF header
readelf -h <target> 2>/dev/null

# Section headers (look for unusual sections)
readelf -S <target> 2>/dev/null

# Program headers
readelf -l <target> 2>/dev/null

# Dynamic section (shared libraries, RPATH)
readelf -d <target> 2>/dev/null

# Symbol table
readelf -s <target> 2>/dev/null | head -50

# Check if stripped
file <target> | grep -i "stripped"

For scripts (Python, PowerShell, Bash, JS):

# Detect obfuscation
head -50 <target>

# Look for encoded payloads
grep -oE "[A-Za-z0-9+/=]{50,}" <target> | head -10
# Try to decode base64 blobs
grep -oE "[A-Za-z0-9+/=]{50,}" <target> | head -5 | while read line; do echo "$line" | base64 -d 2>/dev/null | strings -n 6 | head -5; echo "---"; done

Phase 5: Embedded Content Detection

# Scan for embedded files
binwalk -B <target>

# Entropy analysis (high entropy = encrypted/compressed/packed)
binwalk -E <target> 2>/dev/null

Phase 6: Radare2 Quick Analysis (if available)

# Quick binary info
r2 -q -c "i" <target> 2>/dev/null

# List functions
r2 -q -c "aa; afl" <target> 2>/dev/null | head -30

# Entry point disassembly
r2 -q -c "aa; s entry0; pd 20" <target> 2>/dev/null

# Cross-references to suspicious imports
r2 -q -c "aa; axt @ sym.imp.VirtualAlloc" <target> 2>/dev/null
r2 -q -c "aa; axt @ sym.imp.CreateRemoteThread" <target> 2>/dev/null

Phase 7: YARA Scanning (if available)

# If yara is installed, scan with common rules
yara -r /path/to/rules <target> 2>/dev/null || echo "yara not available or no rules provided"

# Python yara module alternative
python3 -c "
import yara
# Basic packer/crypto detection rules inline
rules = yara.compile(source='''
rule upx_packed { strings: \$upx = \"UPX!\" condition: \$upx }
rule base64_payload { strings: \$b64 = /[A-Za-z0-9+\/=]{100,}/ condition: \$b64 }
rule suspicious_pe { strings: \$mz = \"MZ\" at 0 \$api1 = \"VirtualAlloc\" \$api2 = \"CreateRemoteThread\" condition: \$mz and (\$api1 or \$api2) }
''')
matches = rules.match(sys.argv[1])
for m in matches: print(f'YARA match: {m.rule}')
" <target> 2>/dev/null || echo "python3-yara not available"

Threat Assessment Criteria

Rate the file based on accumulated indicators:

Indicator	Weight
Suspicious API imports (injection, process manipulation)	High
Network-related strings (URLs, IPs, C2 patterns)	High
Anti-analysis/evasion techniques	High
Packed/encrypted sections	Medium
Persistence mechanisms in strings	Medium
Credential theft keywords	Medium
Unusual metadata (fake timestamps, mismatched names)	Low
High entropy sections	Low (supports other findings)

Validation Rules

1. String hits: A suspicious string alone is not proof — correlate with imports, behavior, and context
2. Packing: Confirmed by both high entropy AND packer signatures/section names
3. Malicious intent: Requires MULTIPLE indicators (e.g., injection APIs + network strings + anti-debug)
4. False positive check: Is this a legitimate tool (e.g., Metasploit, nmap) rather than actual malware?

Report Output

Write the report to ./reports/malware-triage-report.md:

# Malware Triage Report

**Date**: <date>
**File**: <filename>
**SHA256**: <hash>
**MD5**: <hash>
**File Type**: <type>
**File Size**: <size>
**Analyst**: Claude Code DFIR

## Executive Summary
<Threat assessment in 2-3 sentences>

## Threat Level: [CRITICAL / HIGH / MEDIUM / LOW / BENIGN]

## File Properties
| Property | Value |
|----------|-------|
| Type     |       |
| Size     |       |
| SHA256   |       |
| MD5      |       |
| Compiled |       |
| Packer   |       |

## Findings

### Finding 1: <Title>
- **Category**: Injection / Evasion / Persistence / C2 / Credential Theft / Other
- **Evidence**: <specific data>
- **Validation**: <how confirmed>
- **MITRE ATT&CK**: <technique ID>
- **Reproduce**:
  ```bash
  <exact command(s) the analyst can copy-paste to independently verify this finding>

Indicators of Compromise

Type	Value	Context
SHA256
MD5
URL
IP
Domain
Mutex
Registry

Suspicious Strings (Curated)

<Top 20 most relevant strings with context>

Recommendations

```

Create the reports/ directory if it does not exist.