reverse-skills-max/vendor-new/malware-analysis-claude-skills/malware-triage/references/triage_checklist.md

Malware Triage Checklist

Initial Assessment Phase

File Information Collection

• Calculate all hashes (MD5, SHA1, SHA256)
• Document original filename
• Record file size
• Identify file type (PE32/PE64/Script/Document/Archive)
• Note file creation/modification timestamps
• Check for file signatures (magic bytes)

Reputation and Context

• Search hash on VirusTotal
• Search hash on MalwareBazaar
• Search hash on Hybrid Analysis
• Check if file is known good/bad
• Review AV detection rates
• Check submission dates and prevalence
• Review any available sandbox reports

Quick Static Indicators

PE Files

• Check if file is packed/compressed (high entropy)
• Identify packer if detected (UPX, ASPack, Themida, etc.)
• Review PE sections (unusual names, high entropy sections)
• Check compilation timestamp (realistic or fake)
• Examine digital signature (signed/unsigned, valid/invalid)
• Review import table for suspicious APIs
• Check for overlay data
• Examine resources (icons, version info, embedded files)

Script Files (PowerShell, JavaScript, VBS, etc.)

• Check for obfuscation
• Identify encoding methods (Base64, hex, etc.)
• Look for download/execution commands
• Check for embedded URLs or IPs
• Review variable/function names (random = suspicious)

Office Documents

• Check for macros
• Examine embedded objects/OLE streams
• Look for external references (templates, links)
• Check for DDE/equation editor exploits
• Review document metadata

Strings Analysis

• Extract readable strings
• Look for URLs and IP addresses
• Identify file paths
• Find registry keys
• Check for email addresses
• Look for error messages or debug strings
• Identify cryptocurrency wallet addresses
• Find mutex names
• Locate service/process names

Behavior Prediction

Based on initial findings, predict likely behaviors:

• Network communication expected?
• File creation/modification expected?
• Registry changes expected?
• Process injection expected?
• Persistence mechanism type?

Classification Phase

Malware Type Determination

• Trojan (general backdoor/RAT)
• Ransomware (file encryption)
• Worm (self-propagating)
• Rootkit (stealth/hiding)
• Botnet client
• Infostealer (credentials, browser data)
• Keylogger
• Backdoor/RAT
• Dropper/Loader
• Cryptominer
• Adware/PUP
• Banking trojan
• Unknown/Hybrid

Sophistication Assessment

• Simple (basic functionality, no obfuscation)
• Moderate (some obfuscation, standard techniques)
• Advanced (heavy obfuscation, anti-analysis)
• APT-level (custom, targeted, advanced evasion)

Threat Level

Based on capabilities and target:

• Critical (destructive, wide impact)
• High (data theft, system compromise)
• Medium (limited functionality, targeted)
• Low (minimal impact, easily detected)

Dynamic Analysis Decision

Should I run dynamic analysis?

YES, if:

• Static analysis insufficient for understanding
• Need to confirm predicted behaviors
• Unknown/new sample requiring behavior observation
• Investigating specific functionality
• Creating behavioral signatures

NO, if:

• Clearly identified as known malware
• Destructive capabilities too risky
• Time constraints for quick triage
• Static analysis provides sufficient information

Safe Execution Requirements

If proceeding with dynamic analysis:

• Isolated VM environment confirmed
• Network isolation configured (or monitoring ready)
• Snapshots taken
• Monitoring tools prepared (Process Monitor, Wireshark, etc.)
• Host system protected
• Backup and recovery plan ready

Priority Assessment

Immediate Priority (Analyze Now)

• Unknown samples with unclear threat level
• Samples matching recent threat intelligence
• Active incident-related samples
• Samples with destructive capabilities
• Targeted/APT-style malware

Standard Priority (Normal Queue)

• Known malware variants
• Common commodity malware
• Samples with clear signatures
• Historical samples for research

Low Priority (Defer if Needed)

• Clearly identified samples
• Adware/PUP with minimal impact
• Old/outdated malware
• Test files or false positives

Initial Findings Summary Template

Use this template to document triage results:

## Triage Summary

**Sample:** [filename]
**Hashes:**
- MD5: [hash]
- SHA1: [hash]  
- SHA256: [hash]

**File Type:** [type]
**Size:** [size]
**Packed:** [Yes/No - Packer name]

**Initial Classification:**
- Type: [Malware type]
- Threat Level: [Critical/High/Medium/Low]
- Sophistication: [Simple/Moderate/Advanced]

**Key Indicators:**
- [Notable finding 1]
- [Notable finding 2]
- [Notable finding 3]

**Predicted Behaviors:**
- [Expected behavior 1]
- [Expected behavior 2]

**Recommendation:**
[Proceed with full analysis / Quick report / Defer]

**Priority:** [Immediate/Standard/Low]

**Next Steps:**
1. [Action 1]
2. [Action 2]

Common Triage Pitfalls

Don't:

• Rush through hash calculation (always get all three)
• Skip online searches (leverage community intelligence)
• Assume packing means malicious (many legitimate software is packed)
• Execute without proper isolation
• Trust timestamps (easily forged)
• Overlook string encoding (Base64, hex, unicode)
• Ignore resource sections (often contain payloads)

Do:

• Document everything immediately
• Use multiple analysis tools
• Verify findings with different methods
• Consider false positive possibilities
• Check for packer signatures before deep analysis
• Review import table carefully
• Look for anti-analysis techniques
• Consider file context (how obtained, where found)

Time-Efficient Triage

For efficient time management:

5-minute triage:

• Calculate hashes
• Check online databases
• Run strings
• Check packer

15-minute triage:

• Above +
• PE header analysis
• Import table review
• Resource examination
• Quick prediction

30-minute triage:

• Above +
• Detailed strings analysis
• Preliminary YARA rule concepts
• Behavior prediction writeup
• Classification and prioritization

Tools Quick Reference

Hash Calculation:

• scripts/hash_calculator.py
• CertUtil (Windows): certutil -hashfile file.exe SHA256
• sha256sum (Linux): sha256sum file.exe

Online Databases:

• VirusTotal: virustotal.com
• MalwareBazaar: bazaar.abuse.ch
• Hybrid Analysis: hybrid-analysis.com
• Any.Run: any.run

Static Analysis:

• PE analysis: pestudio, PEview, CFF Explorer
• Strings: strings.exe, FLOSS
• Hex editor: HxD, 010 Editor
• Packer detection: Detect It Easy (DIE), Exeinfo PE

Quick Sandboxing:

• Any.Run (interactive)
• Hybrid Analysis
• Joe Sandbox
• Cuckoo (self-hosted)