reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/malware-analysis-claude-skills/malware-triage/references/triage_checklist.md

@@ -0,0 +1,252 @@
+# Malware Triage Checklist
+
+## Initial Assessment Phase
+
+### File Information Collection
+- [ ] Calculate all hashes (MD5, SHA1, SHA256)
+- [ ] Document original filename
+- [ ] Record file size
+- [ ] Identify file type (PE32/PE64/Script/Document/Archive)
+- [ ] Note file creation/modification timestamps
+- [ ] Check for file signatures (magic bytes)
+
+### Reputation and Context
+- [ ] Search hash on VirusTotal
+- [ ] Search hash on MalwareBazaar
+- [ ] Search hash on Hybrid Analysis
+- [ ] Check if file is known good/bad
+- [ ] Review AV detection rates
+- [ ] Check submission dates and prevalence
+- [ ] Review any available sandbox reports
+
+### Quick Static Indicators
+
+#### PE Files
+- [ ] Check if file is packed/compressed (high entropy)
+- [ ] Identify packer if detected (UPX, ASPack, Themida, etc.)
+- [ ] Review PE sections (unusual names, high entropy sections)
+- [ ] Check compilation timestamp (realistic or fake)
+- [ ] Examine digital signature (signed/unsigned, valid/invalid)
+- [ ] Review import table for suspicious APIs
+- [ ] Check for overlay data
+- [ ] Examine resources (icons, version info, embedded files)
+
+#### Script Files (PowerShell, JavaScript, VBS, etc.)
+- [ ] Check for obfuscation
+- [ ] Identify encoding methods (Base64, hex, etc.)
+- [ ] Look for download/execution commands
+- [ ] Check for embedded URLs or IPs
+- [ ] Review variable/function names (random = suspicious)
+
+#### Office Documents
+- [ ] Check for macros
+- [ ] Examine embedded objects/OLE streams
+- [ ] Look for external references (templates, links)
+- [ ] Check for DDE/equation editor exploits
+- [ ] Review document metadata
+
+### Strings Analysis
+- [ ] Extract readable strings
+- [ ] Look for URLs and IP addresses
+- [ ] Identify file paths
+- [ ] Find registry keys
+- [ ] Check for email addresses
+- [ ] Look for error messages or debug strings
+- [ ] Identify cryptocurrency wallet addresses
+- [ ] Find mutex names
+- [ ] Locate service/process names
+
+### Behavior Prediction
+Based on initial findings, predict likely behaviors:
+- [ ] Network communication expected?
+- [ ] File creation/modification expected?
+- [ ] Registry changes expected?
+- [ ] Process injection expected?
+- [ ] Persistence mechanism type?
+
+## Classification Phase
+
+### Malware Type Determination
+- [ ] Trojan (general backdoor/RAT)
+- [ ] Ransomware (file encryption)
+- [ ] Worm (self-propagating)
+- [ ] Rootkit (stealth/hiding)
+- [ ] Botnet client
+- [ ] Infostealer (credentials, browser data)
+- [ ] Keylogger
+- [ ] Backdoor/RAT
+- [ ] Dropper/Loader
+- [ ] Cryptominer
+- [ ] Adware/PUP
+- [ ] Banking trojan
+- [ ] Unknown/Hybrid
+
+### Sophistication Assessment
+- [ ] Simple (basic functionality, no obfuscation)
+- [ ] Moderate (some obfuscation, standard techniques)
+- [ ] Advanced (heavy obfuscation, anti-analysis)
+- [ ] APT-level (custom, targeted, advanced evasion)
+
+### Threat Level
+Based on capabilities and target:
+- [ ] Critical (destructive, wide impact)
+- [ ] High (data theft, system compromise)
+- [ ] Medium (limited functionality, targeted)
+- [ ] Low (minimal impact, easily detected)
+
+## Dynamic Analysis Decision
+
+### Should I run dynamic analysis?
+**YES, if:**
+- Static analysis insufficient for understanding
+- Need to confirm predicted behaviors
+- Unknown/new sample requiring behavior observation
+- Investigating specific functionality
+- Creating behavioral signatures
+
+**NO, if:**
+- Clearly identified as known malware
+- Destructive capabilities too risky
+- Time constraints for quick triage
+- Static analysis provides sufficient information
+
+### Safe Execution Requirements
+If proceeding with dynamic analysis:
+- [ ] Isolated VM environment confirmed
+- [ ] Network isolation configured (or monitoring ready)
+- [ ] Snapshots taken
+- [ ] Monitoring tools prepared (Process Monitor, Wireshark, etc.)
+- [ ] Host system protected
+- [ ] Backup and recovery plan ready
+
+## Priority Assessment
+
+### Immediate Priority (Analyze Now)
+- Unknown samples with unclear threat level
+- Samples matching recent threat intelligence
+- Active incident-related samples
+- Samples with destructive capabilities
+- Targeted/APT-style malware
+
+### Standard Priority (Normal Queue)
+- Known malware variants
+- Common commodity malware
+- Samples with clear signatures
+- Historical samples for research
+
+### Low Priority (Defer if Needed)
+- Clearly identified samples
+- Adware/PUP with minimal impact
+- Old/outdated malware
+- Test files or false positives
+
+## Initial Findings Summary Template
+
+Use this template to document triage results:
+
+```
+## Triage Summary
+
+**Sample:** [filename]
+**Hashes:**
+- MD5: [hash]
+- SHA1: [hash]  
+- SHA256: [hash]
+
+**File Type:** [type]
+**Size:** [size]
+**Packed:** [Yes/No - Packer name]
+
+**Initial Classification:**
+- Type: [Malware type]
+- Threat Level: [Critical/High/Medium/Low]
+- Sophistication: [Simple/Moderate/Advanced]
+
+**Key Indicators:**
+- [Notable finding 1]
+- [Notable finding 2]
+- [Notable finding 3]
+
+**Predicted Behaviors:**
+- [Expected behavior 1]
+- [Expected behavior 2]
+
+**Recommendation:**
+[Proceed with full analysis / Quick report / Defer]
+
+**Priority:** [Immediate/Standard/Low]
+
+**Next Steps:**
+1. [Action 1]
+2. [Action 2]
+```
+
+## Common Triage Pitfalls
+
+### Don't:
+- Rush through hash calculation (always get all three)
+- Skip online searches (leverage community intelligence)
+- Assume packing means malicious (many legitimate software is packed)
+- Execute without proper isolation
+- Trust timestamps (easily forged)
+- Overlook string encoding (Base64, hex, unicode)
+- Ignore resource sections (often contain payloads)
+
+### Do:
+- Document everything immediately
+- Use multiple analysis tools
+- Verify findings with different methods
+- Consider false positive possibilities
+- Check for packer signatures before deep analysis
+- Review import table carefully
+- Look for anti-analysis techniques
+- Consider file context (how obtained, where found)
+
+## Time-Efficient Triage
+
+For efficient time management:
+
+**5-minute triage:**
+- Calculate hashes
+- Check online databases
+- Run strings
+- Check packer
+
+**15-minute triage:**
+- Above +
+- PE header analysis
+- Import table review
+- Resource examination
+- Quick prediction
+
+**30-minute triage:**
+- Above +
+- Detailed strings analysis
+- Preliminary YARA rule concepts
+- Behavior prediction writeup
+- Classification and prioritization
+
+## Tools Quick Reference
+
+**Hash Calculation:**
+- `scripts/hash_calculator.py`
+- CertUtil (Windows): `certutil -hashfile file.exe SHA256`
+- sha256sum (Linux): `sha256sum file.exe`
+
+**Online Databases:**
+- VirusTotal: virustotal.com
+- MalwareBazaar: bazaar.abuse.ch
+- Hybrid Analysis: hybrid-analysis.com
+- Any.Run: any.run
+
+**Static Analysis:**
+- PE analysis: pestudio, PEview, CFF Explorer
+- Strings: strings.exe, FLOSS
+- Hex editor: HxD, 010 Editor
+- Packer detection: Detect It Easy (DIE), Exeinfo PE
+
+**Quick Sandboxing:**
+- Any.Run (interactive)
+- Hybrid Analysis
+- Joe Sandbox
+- Cuckoo (self-hosted)