reverse-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok609hecl1pq6qi
@@ -0,0 +1,325 @@
|
||||
# Common Malware Indicators Reference
|
||||
|
||||
## Suspicious Import Functions
|
||||
|
||||
### Process Injection/Manipulation
|
||||
- `CreateRemoteThread` - Inject code into another process
|
||||
- `WriteProcessMemory` - Write to another process's memory
|
||||
- `VirtualAllocEx` - Allocate memory in another process
|
||||
- `OpenProcess` - Access another process
|
||||
- `NtUnmapViewOfSection` - Process hollowing technique
|
||||
- `SetThreadContext` - Modify thread execution
|
||||
- `ResumeThread` - Resume suspended thread (often after injection)
|
||||
- `QueueUserAPC` - APC injection technique
|
||||
|
||||
### Keylogging
|
||||
- `SetWindowsHookEx` - Install keyboard hooks
|
||||
- `GetAsyncKeyState` - Poll keyboard state
|
||||
- `GetForegroundWindow` - Get active window title
|
||||
- `GetKeyState` - Check key status
|
||||
|
||||
### Network Activity
|
||||
- `InternetOpen` / `InternetOpenUrl` - WinINet HTTP requests
|
||||
- `HttpSendRequest` - Send HTTP request
|
||||
- `send` / `recv` - Raw socket communication
|
||||
- `WSAStartup` - Initialize Winsock
|
||||
- `connect` / `socket` - Network connections
|
||||
- `URLDownloadToFile` - Download files from URLs
|
||||
|
||||
### Persistence Mechanisms
|
||||
- `RegSetValueEx` / `RegCreateKeyEx` - Registry manipulation
|
||||
- `CreateService` - Install Windows service
|
||||
- `StartService` - Start service
|
||||
- `ITaskService` / `ITaskFolder::RegisterTaskDefinition` - COM interfaces for scheduled task creation; `schtasks.exe /create` is the command-line equivalent
|
||||
|
||||
### Stealth/Anti-Analysis
|
||||
- `IsDebuggerPresent` - Debugger detection
|
||||
- `CheckRemoteDebuggerPresent` - Remote debugger check
|
||||
- `NtQueryInformationProcess` - Process information (anti-debug)
|
||||
- `GetTickCount` - Timing checks (anti-sandbox)
|
||||
- `Sleep` - Delay execution (sandbox evasion)
|
||||
- `FindWindow` - Look for analysis tools
|
||||
|
||||
### EDR/Telemetry Evasion
|
||||
- `EtwEventWrite` / `NtTraceEvent` - ETW patching target; writing 0xC3 (ret) to prologue blinds EDR telemetry
|
||||
- `AmsiScanBuffer` / `AmsiScanString` / `AmsiInitialize` - AMSI bypass targets; patched to return S_OK (0) with AMSI_RESULT_CLEAN (0), or to return E_INVALIDARG so the caller treats the result as no threat
|
||||
- `UpdateProcThreadAttribute` - PPID spoofing when called with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute
|
||||
- `VirtualProtect` - Required before patching; look for calls targeting ntdll.dll or amsi.dll memory ranges
|
||||
- `GetProcAddress` + `LoadLibrary` - Runtime API resolution to avoid static import evidence (common in syscall stubs)
|
||||
|
||||
### Callback-based Shellcode Execution
|
||||
- `EnumChildWindows` / `EnumDesktopWindows` - Callback used as execution primitive instead of CreateThread
|
||||
- `CreateTimerQueueTimer` - Timer callback used to invoke shellcode
|
||||
- `TpAllocWork` / `TpPostWork` / `TpReleaseWork` - Threadpool callbacks for shellcode dispatch
|
||||
- `SetTimer` / `EnumSystemLocales` / `EnumTimeFormatsEx` - Less common callback execution primitives
|
||||
|
||||
### File Manipulation
|
||||
- `CreateFile` / `WriteFile` / `ReadFile` - File I/O
|
||||
- `DeleteFile` - Delete files
|
||||
- `MoveFile` / `CopyFile` - File operations
|
||||
- `FindFirstFile` / `FindNextFile` - Directory enumeration
|
||||
|
||||
### Encryption/Encoding
|
||||
- `CryptEncrypt` / `CryptDecrypt` - Data encryption
|
||||
- `CryptAcquireContext` - Crypto provider setup
|
||||
- `CryptGenKey` - Generate encryption keys
|
||||
|
||||
## Suspicious String Patterns
|
||||
|
||||
### Network Indicators
|
||||
- Hardcoded IP addresses (especially RFC1918 or suspicious IPs)
|
||||
- Domain names (especially newly registered or suspicious TLDs)
|
||||
- URL patterns: `http://`, `https://`, `ftp://`
|
||||
- Port numbers in strings (especially non-standard ports)
|
||||
- User-Agent strings (especially custom/unusual ones)
|
||||
- Email addresses (especially for data exfiltration)
|
||||
|
||||
### File Paths
|
||||
- `%APPDATA%`, `%TEMP%`, `%LOCALAPPDATA%` - Common malware locations
|
||||
- `\Microsoft\Windows\Start Menu\Programs\Startup\` - Persistence
|
||||
- `C:\ProgramData\` - Hidden location
|
||||
- Hidden folders: `$Recycle.Bin`, `System Volume Information`
|
||||
|
||||
### Registry Keys
|
||||
**Persistence (Run Keys):**
|
||||
- `Software\Microsoft\Windows\CurrentVersion\Run`
|
||||
- `Software\Microsoft\Windows\CurrentVersion\RunOnce`
|
||||
- `SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices`
|
||||
|
||||
**System Modification:**
|
||||
- `SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon` (especially Userinit, Shell)
|
||||
- `SYSTEM\CurrentControlSet\Services` - Service installation
|
||||
- `SOFTWARE\Microsoft\Windows\CurrentVersion\policies` - Policy changes
|
||||
|
||||
### Commands and Scripts
|
||||
- PowerShell indicators:
|
||||
- `-EncodedCommand` - Base64 encoded commands
|
||||
- `-ExecutionPolicy Bypass` - Bypass script restrictions
|
||||
- `-WindowStyle Hidden` - Hide execution
|
||||
- `DownloadString`, `DownloadFile` - Download payloads
|
||||
- `IEX` (Invoke-Expression) - Execute code
|
||||
|
||||
- CMD indicators:
|
||||
- `cmd.exe /c` - Execute command
|
||||
- `schtasks` - Task scheduling
|
||||
- `reg add` - Registry manipulation
|
||||
- `netsh` - Network/firewall changes
|
||||
- `wmic` - WMI commands
|
||||
- `rundll32` - Execute DLL functions
|
||||
|
||||
### Encoding/Obfuscation
|
||||
- Base64 encoded strings (check for padding: `==`)
|
||||
- Hex encoded data
|
||||
- XOR key patterns
|
||||
- Reversed strings
|
||||
- Unicode/wide character strings
|
||||
|
||||
### Cryptocurrency
|
||||
- Bitcoin addresses (start with 1, 3, or bc1)
|
||||
- Ethereum addresses (0x followed by 40 hex chars)
|
||||
- Monero addresses
|
||||
- Wallet-related terms: "wallet.dat", "cryptocurrency"
|
||||
|
||||
### Ransomware Indicators
|
||||
- File extension strings: `.encrypted`, `.locked`, `.crypto`, etc.
|
||||
- Ransom note filenames: `README.txt`, `HOW_TO_DECRYPT.txt`
|
||||
- Payment terms: "bitcoin", "decrypt", "ransom", "payment"
|
||||
- Encryption terms: "AES", "RSA", "encrypted"
|
||||
|
||||
## Suspicious File Characteristics
|
||||
|
||||
### PE Header Anomalies
|
||||
- Compilation timestamp in the future
|
||||
- Compilation timestamp too old for file features
|
||||
- Mismatched architecture in headers
|
||||
- Unusual section names (normal: `.text`, `.data`, `.rdata`, `.rsrc`)
|
||||
- High entropy sections (>7.0 suggests encryption/packing)
|
||||
- Overlapping sections
|
||||
- Large overlay data
|
||||
- Missing or invalid digital signatures
|
||||
|
||||
### Entropy Analysis
|
||||
- **Low entropy (0-3):** Likely unencrypted, readable data
|
||||
- **Medium entropy (3-5):** Typical compiled code
|
||||
- **High entropy (7-8):** Packed, encrypted, or compressed
|
||||
- Check individual PE sections for high entropy
|
||||
|
||||
### Packer Signatures
|
||||
**Common packers:**
|
||||
- UPX (common, legitimate and malicious)
|
||||
- ASPack
|
||||
- PECompact
|
||||
- Themida/WinLicense (strong protection)
|
||||
- Armadillo
|
||||
- VMProtect
|
||||
- Enigma Protector
|
||||
- Custom/unknown packers (more suspicious)
|
||||
|
||||
### File Size Oddities
|
||||
- Very small for claimed functionality (<10KB for complex malware)
|
||||
- Unusually large resources section
|
||||
- Significant overlay data
|
||||
- File size doesn't match claimed type
|
||||
|
||||
## Behavioral Indicators
|
||||
|
||||
### Anti-Analysis Behaviors
|
||||
- Checks for VM artifacts (VMware, VirtualBox, QEMU)
|
||||
- Looks for debugger presence
|
||||
- Timing checks (execution delays)
|
||||
- Checks for analysis tools (Process Monitor, Wireshark, IDA)
|
||||
- Sandbox detection (limited resources, username checks)
|
||||
- Parent process verification
|
||||
- Mouse movement monitoring
|
||||
- Checks for user interaction
|
||||
|
||||
### Modern EDR/AV Evasion Techniques
|
||||
|
||||
**ETW Patching:**
|
||||
- Overwrites the prologue of `EtwEventWrite` or `NtTraceEvent` with a `ret` instruction (0xC3) to suppress Event Tracing for Windows telemetry
|
||||
- Look for: `VirtualProtect` → `WriteProcessMemory`/`memcpy` targeting ntdll address space, followed by restoration of original page protections
|
||||
- Effect: EDR and ETW-based logging goes blind for the process lifetime
|
||||
|
||||
**AMSI Bypass:**
|
||||
- Patches `AmsiScanBuffer` or `AmsiScanString` in amsi.dll to return S_OK (0) with `AMSI_RESULT_CLEAN` (0), or to return E_INVALIDARG so the caller treats the result as no threat; disables script content scanning
|
||||
- Look for: `LoadLibrary("amsi.dll")` + `GetProcAddress` + `VirtualProtect` + small write (1-8 bytes); or `AmsiInitialize` never called while PowerShell/script engine is used
|
||||
- Effect: Malicious PowerShell, VBScript, or JScript passes AMSI unchecked
|
||||
|
||||
**Direct Syscalls / SysWhispers:**
|
||||
- Bypasses EDR hooks placed on ntdll.dll exports by issuing raw syscall/sysenter instructions with the correct System Service Number (SSN)
|
||||
- Look for: `syscall` or `sysenter` instructions in non-system modules (use `objdump`/`dumpbin`); runtime SSN resolution via ntdll stub scanning (Hell's Gate, Halo's Gate, Tartarus Gate patterns); absence of ntdll imports for expected operations (no `NtAllocateVirtualMemory` import but memory is allocated)
|
||||
- Common SSNs targeted: NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx, NtProtectVirtualMemory
|
||||
|
||||
**PPID Spoofing:**
|
||||
- Creates a child process with a forged parent PID by passing a handle to the target parent via `UpdateProcThreadAttribute(PROC_THREAD_ATTRIBUTE_PARENT_PROCESS)` before calling `CreateProcess`
|
||||
- Look for: `OpenProcess` on an unrelated high-privilege process (e.g., explorer.exe, svchost.exe) immediately before `CreateProcess`; process tree in logs showing implausible parent-child relationships
|
||||
- Effect: Evades detections that trigger on suspicious parent-child pairs (e.g., Word spawning cmd.exe)
|
||||
|
||||
**Module Stomping / DLL Hollowing:**
|
||||
- Loads a legitimate, signed DLL into memory then overwrites its `.text` section with malicious shellcode, so execution appears to originate from a trusted module
|
||||
- Look for: `LoadLibrary` on an unexpected DLL followed by `VirtualProtect(PAGE_EXECUTE_READWRITE)` and `WriteProcessMemory`/`memcpy` into that DLL's base address; signed DLL mapped but exports resolve to unexpected code
|
||||
- Distinguish from process hollowing: the host process is not suspended — the stomped DLL simply runs attacker code under a legitimate module name
|
||||
|
||||
### Persistence Techniques
|
||||
- Registry Run key modification
|
||||
- Scheduled task creation
|
||||
- Service installation
|
||||
- WMI event subscriptions
|
||||
- DLL hijacking/search order hijacking
|
||||
- AppInit_DLLs registry key
|
||||
- Startup folder files
|
||||
- Browser extension installation
|
||||
|
||||
### Network Patterns
|
||||
- Beaconing (regular C2 communication)
|
||||
- HTTP with suspicious User-Agents
|
||||
- Raw socket connections
|
||||
- IRC protocols
|
||||
- DNS tunneling (unusual DNS queries)
|
||||
- TOR usage
|
||||
- Fast flux domains
|
||||
|
||||
### Data Exfiltration
|
||||
- Unusual outbound data volumes
|
||||
- Screenshots being taken
|
||||
- Credential harvesting
|
||||
- Browser data collection
|
||||
- Keylogger output transmission
|
||||
- File upload to external servers
|
||||
|
||||
## Red Flags by File Type
|
||||
|
||||
### Executable Files (.exe, .dll, .scr)
|
||||
- No digital signature or invalid signature
|
||||
- Packed/protected
|
||||
- Very few imports (possibly resolved at runtime)
|
||||
- Unusual compilation timestamp
|
||||
- Suspicious filename mimicking system files
|
||||
|
||||
### Script Files (.ps1, .vbs, .js, .bat)
|
||||
- Heavy obfuscation
|
||||
- Base64 encoded sections
|
||||
- Download and execute patterns
|
||||
- WMI usage for execution
|
||||
- Registry manipulation
|
||||
|
||||
### Office Documents (.doc, .xls, .docx, .xlsx)
|
||||
- Macros enabled
|
||||
- Auto-execute macro names (AutoOpen, Auto_Open, Workbook_Open)
|
||||
- External template references
|
||||
- Embedded objects
|
||||
- Suspicious OLE streams
|
||||
|
||||
### Archive Files (.zip, .rar, .7z)
|
||||
- Executable files with misleading extensions
|
||||
- Multi-layer nested archives
|
||||
- Password-protected archives (especially with generic passwords)
|
||||
- Suspicious filenames inside
|
||||
|
||||
## Quick Classification Patterns
|
||||
|
||||
### Ransomware
|
||||
- File encryption APIs
|
||||
- Many file I/O operations
|
||||
- File extension changes
|
||||
- Ransom note creation
|
||||
- Cryptocurrency addresses
|
||||
- File deletion after encryption
|
||||
|
||||
### Trojan/RAT
|
||||
- Network communication APIs
|
||||
- Remote control capabilities
|
||||
- Screen capture
|
||||
- File transfer
|
||||
- Command execution
|
||||
- Persistence mechanisms
|
||||
|
||||
### Infostealer
|
||||
- Browser data access
|
||||
- Credential harvesting
|
||||
- Clipboard monitoring
|
||||
- Form grabbing
|
||||
- Cookie stealing
|
||||
- Cryptocurrency wallet targeting
|
||||
|
||||
### Dropper/Loader
|
||||
- Embedded resources
|
||||
- Creates and executes files
|
||||
- Downloads additional payloads
|
||||
- Process injection
|
||||
- Minimal visible functionality
|
||||
|
||||
### Cryptominer
|
||||
- High CPU usage
|
||||
- Mining pool connections
|
||||
- Cryptocurrency-related strings
|
||||
- GPU access APIs
|
||||
- Persistence with hidden processes
|
||||
|
||||
## Tool Detection Strings
|
||||
|
||||
Malware often checks for these analysis tools:
|
||||
|
||||
**Debuggers:**
|
||||
- OllyDbg, x64dbg, IDA Pro, WinDbg
|
||||
- Immunity Debugger
|
||||
|
||||
**Monitors:**
|
||||
- Process Monitor (procmon), Process Explorer
|
||||
- Wireshark, Fiddler
|
||||
- TCPView, RegShot
|
||||
|
||||
**Sandboxes:**
|
||||
- Cuckoo, Joe Sandbox
|
||||
- Any.Run, Hybrid Analysis
|
||||
- VMRay, FireEye
|
||||
|
||||
**VM Artifacts:**
|
||||
- "VMware", "VirtualBox", "QEMU", "Hyper-V"
|
||||
- "vmmouse", "vmhgfs", "vboxguest"
|
||||
- Registry keys related to VMs
|
||||
|
||||
**Analysis Artifacts:**
|
||||
- Username: "sandbox", "malware", "virus", "sample"
|
||||
- Hostname: "VIRUS-PC", "MALWARE-ANALYSIS"
|
||||
- Limited resources (low RAM, CPU count)
|
||||
@@ -0,0 +1,252 @@
|
||||
# Malware Triage Checklist
|
||||
|
||||
## Initial Assessment Phase
|
||||
|
||||
### File Information Collection
|
||||
- [ ] Calculate all hashes (MD5, SHA1, SHA256)
|
||||
- [ ] Document original filename
|
||||
- [ ] Record file size
|
||||
- [ ] Identify file type (PE32/PE64/Script/Document/Archive)
|
||||
- [ ] Note file creation/modification timestamps
|
||||
- [ ] Check for file signatures (magic bytes)
|
||||
|
||||
### Reputation and Context
|
||||
- [ ] Search hash on VirusTotal
|
||||
- [ ] Search hash on MalwareBazaar
|
||||
- [ ] Search hash on Hybrid Analysis
|
||||
- [ ] Check if file is known good/bad
|
||||
- [ ] Review AV detection rates
|
||||
- [ ] Check submission dates and prevalence
|
||||
- [ ] Review any available sandbox reports
|
||||
|
||||
### Quick Static Indicators
|
||||
|
||||
#### PE Files
|
||||
- [ ] Check if file is packed/compressed (high entropy)
|
||||
- [ ] Identify packer if detected (UPX, ASPack, Themida, etc.)
|
||||
- [ ] Review PE sections (unusual names, high entropy sections)
|
||||
- [ ] Check compilation timestamp (realistic or fake)
|
||||
- [ ] Examine digital signature (signed/unsigned, valid/invalid)
|
||||
- [ ] Review import table for suspicious APIs
|
||||
- [ ] Check for overlay data
|
||||
- [ ] Examine resources (icons, version info, embedded files)
|
||||
|
||||
#### Script Files (PowerShell, JavaScript, VBS, etc.)
|
||||
- [ ] Check for obfuscation
|
||||
- [ ] Identify encoding methods (Base64, hex, etc.)
|
||||
- [ ] Look for download/execution commands
|
||||
- [ ] Check for embedded URLs or IPs
|
||||
- [ ] Review variable/function names (random = suspicious)
|
||||
|
||||
#### Office Documents
|
||||
- [ ] Check for macros
|
||||
- [ ] Examine embedded objects/OLE streams
|
||||
- [ ] Look for external references (templates, links)
|
||||
- [ ] Check for DDE/equation editor exploits
|
||||
- [ ] Review document metadata
|
||||
|
||||
### Strings Analysis
|
||||
- [ ] Extract readable strings
|
||||
- [ ] Look for URLs and IP addresses
|
||||
- [ ] Identify file paths
|
||||
- [ ] Find registry keys
|
||||
- [ ] Check for email addresses
|
||||
- [ ] Look for error messages or debug strings
|
||||
- [ ] Identify cryptocurrency wallet addresses
|
||||
- [ ] Find mutex names
|
||||
- [ ] Locate service/process names
|
||||
|
||||
### Behavior Prediction
|
||||
Based on initial findings, predict likely behaviors:
|
||||
- [ ] Network communication expected?
|
||||
- [ ] File creation/modification expected?
|
||||
- [ ] Registry changes expected?
|
||||
- [ ] Process injection expected?
|
||||
- [ ] Persistence mechanism type?
|
||||
|
||||
## Classification Phase
|
||||
|
||||
### Malware Type Determination
|
||||
- [ ] Trojan (general backdoor/RAT)
|
||||
- [ ] Ransomware (file encryption)
|
||||
- [ ] Worm (self-propagating)
|
||||
- [ ] Rootkit (stealth/hiding)
|
||||
- [ ] Botnet client
|
||||
- [ ] Infostealer (credentials, browser data)
|
||||
- [ ] Keylogger
|
||||
- [ ] Backdoor/RAT
|
||||
- [ ] Dropper/Loader
|
||||
- [ ] Cryptominer
|
||||
- [ ] Adware/PUP
|
||||
- [ ] Banking trojan
|
||||
- [ ] Unknown/Hybrid
|
||||
|
||||
### Sophistication Assessment
|
||||
- [ ] Simple (basic functionality, no obfuscation)
|
||||
- [ ] Moderate (some obfuscation, standard techniques)
|
||||
- [ ] Advanced (heavy obfuscation, anti-analysis)
|
||||
- [ ] APT-level (custom, targeted, advanced evasion)
|
||||
|
||||
### Threat Level
|
||||
Based on capabilities and target:
|
||||
- [ ] Critical (destructive, wide impact)
|
||||
- [ ] High (data theft, system compromise)
|
||||
- [ ] Medium (limited functionality, targeted)
|
||||
- [ ] Low (minimal impact, easily detected)
|
||||
|
||||
## Dynamic Analysis Decision
|
||||
|
||||
### Should I run dynamic analysis?
|
||||
**YES, if:**
|
||||
- Static analysis insufficient for understanding
|
||||
- Need to confirm predicted behaviors
|
||||
- Unknown/new sample requiring behavior observation
|
||||
- Investigating specific functionality
|
||||
- Creating behavioral signatures
|
||||
|
||||
**NO, if:**
|
||||
- Clearly identified as known malware
|
||||
- Destructive capabilities too risky
|
||||
- Time constraints for quick triage
|
||||
- Static analysis provides sufficient information
|
||||
|
||||
### Safe Execution Requirements
|
||||
If proceeding with dynamic analysis:
|
||||
- [ ] Isolated VM environment confirmed
|
||||
- [ ] Network isolation configured (or monitoring ready)
|
||||
- [ ] Snapshots taken
|
||||
- [ ] Monitoring tools prepared (Process Monitor, Wireshark, etc.)
|
||||
- [ ] Host system protected
|
||||
- [ ] Backup and recovery plan ready
|
||||
|
||||
## Priority Assessment
|
||||
|
||||
### Immediate Priority (Analyze Now)
|
||||
- Unknown samples with unclear threat level
|
||||
- Samples matching recent threat intelligence
|
||||
- Active incident-related samples
|
||||
- Samples with destructive capabilities
|
||||
- Targeted/APT-style malware
|
||||
|
||||
### Standard Priority (Normal Queue)
|
||||
- Known malware variants
|
||||
- Common commodity malware
|
||||
- Samples with clear signatures
|
||||
- Historical samples for research
|
||||
|
||||
### Low Priority (Defer if Needed)
|
||||
- Clearly identified samples
|
||||
- Adware/PUP with minimal impact
|
||||
- Old/outdated malware
|
||||
- Test files or false positives
|
||||
|
||||
## Initial Findings Summary Template
|
||||
|
||||
Use this template to document triage results:
|
||||
|
||||
```
|
||||
## Triage Summary
|
||||
|
||||
**Sample:** [filename]
|
||||
**Hashes:**
|
||||
- MD5: [hash]
|
||||
- SHA1: [hash]
|
||||
- SHA256: [hash]
|
||||
|
||||
**File Type:** [type]
|
||||
**Size:** [size]
|
||||
**Packed:** [Yes/No - Packer name]
|
||||
|
||||
**Initial Classification:**
|
||||
- Type: [Malware type]
|
||||
- Threat Level: [Critical/High/Medium/Low]
|
||||
- Sophistication: [Simple/Moderate/Advanced]
|
||||
|
||||
**Key Indicators:**
|
||||
- [Notable finding 1]
|
||||
- [Notable finding 2]
|
||||
- [Notable finding 3]
|
||||
|
||||
**Predicted Behaviors:**
|
||||
- [Expected behavior 1]
|
||||
- [Expected behavior 2]
|
||||
|
||||
**Recommendation:**
|
||||
[Proceed with full analysis / Quick report / Defer]
|
||||
|
||||
**Priority:** [Immediate/Standard/Low]
|
||||
|
||||
**Next Steps:**
|
||||
1. [Action 1]
|
||||
2. [Action 2]
|
||||
```
|
||||
|
||||
## Common Triage Pitfalls
|
||||
|
||||
### Don't:
|
||||
- Rush through hash calculation (always get all three)
|
||||
- Skip online searches (leverage community intelligence)
|
||||
- Assume packing means malicious (many legitimate software is packed)
|
||||
- Execute without proper isolation
|
||||
- Trust timestamps (easily forged)
|
||||
- Overlook string encoding (Base64, hex, unicode)
|
||||
- Ignore resource sections (often contain payloads)
|
||||
|
||||
### Do:
|
||||
- Document everything immediately
|
||||
- Use multiple analysis tools
|
||||
- Verify findings with different methods
|
||||
- Consider false positive possibilities
|
||||
- Check for packer signatures before deep analysis
|
||||
- Review import table carefully
|
||||
- Look for anti-analysis techniques
|
||||
- Consider file context (how obtained, where found)
|
||||
|
||||
## Time-Efficient Triage
|
||||
|
||||
For efficient time management:
|
||||
|
||||
**5-minute triage:**
|
||||
- Calculate hashes
|
||||
- Check online databases
|
||||
- Run strings
|
||||
- Check packer
|
||||
|
||||
**15-minute triage:**
|
||||
- Above +
|
||||
- PE header analysis
|
||||
- Import table review
|
||||
- Resource examination
|
||||
- Quick prediction
|
||||
|
||||
**30-minute triage:**
|
||||
- Above +
|
||||
- Detailed strings analysis
|
||||
- Preliminary YARA rule concepts
|
||||
- Behavior prediction writeup
|
||||
- Classification and prioritization
|
||||
|
||||
## Tools Quick Reference
|
||||
|
||||
**Hash Calculation:**
|
||||
- `scripts/hash_calculator.py`
|
||||
- CertUtil (Windows): `certutil -hashfile file.exe SHA256`
|
||||
- sha256sum (Linux): `sha256sum file.exe`
|
||||
|
||||
**Online Databases:**
|
||||
- VirusTotal: virustotal.com
|
||||
- MalwareBazaar: bazaar.abuse.ch
|
||||
- Hybrid Analysis: hybrid-analysis.com
|
||||
- Any.Run: any.run
|
||||
|
||||
**Static Analysis:**
|
||||
- PE analysis: pestudio, PEview, CFF Explorer
|
||||
- Strings: strings.exe, FLOSS
|
||||
- Hex editor: HxD, 010 Editor
|
||||
- Packer detection: Detect It Easy (DIE), Exeinfo PE
|
||||
|
||||
**Quick Sandboxing:**
|
||||
- Any.Run (interactive)
|
||||
- Hybrid Analysis
|
||||
- Joe Sandbox
|
||||
- Cuckoo (self-hosted)
|
||||
Reference in New Issue
Block a user