Example: autonomous triage run

This is a real, unedited triage produced by Claude Code running the malware-triage skill headless against the benign test fixture (tests/make_pe.py — a PE that only calls ExitProcess(0) but imports injection/network/persistence APIs and embeds C2-like strings to exercise every heuristic).

Reproduce it:

python3 tests/make_pe.py tests/out/invoice_2024.exe
claude -p "Read malware-triage/SKILL.md and follow it to triage \
  tests/out/invoice_2024.exe. Do not execute the sample." \
  --dangerously-skip-permissions

With no further prompting Claude ran file, the hash calculator, pe_info.py, strings (ASCII + UTF-16), and ioc_extract.py; hand-decoded the 16-byte .text section; recognised from full code coverage that the binary only exits; and returned the verdict below — correctly benign, while noting the static surface mimics a dropper. Model: claude-fable-5-1. Cost: $1.39.

Triage Report — invoice_2024.exe

Hashes: MD5 a7552cd2ee8036124191ce165e34f0ab / SHA1 56125768236e57cc5587e5d52d85deb73fc64401 / SHA256 af747150f9afc0937a6b62755f9bd84cfb88726370f6007ac03f8f7504d38c4d Size: 3602 bytes Type: PE32 x86 console EXE, 3 sections, not .NET Packed: No Reputation: not checked. No VirusTotal / MalwareBazaar MCP in session. Look up SHA256 above; fixture hash likely has no record.

Static Findings

Compile / linker / signature / PDB: timestamp 2024-01-01T00:00:00Z (round, synthetic). Linker 14.0, no Rich header. Unsigned. PDB path present only as loose string, not in debug directory: D:\build\fixture\Release\invoice.pdb.
Sections: .text 16 bytes, entropy 0.24, holds entry point. .rdata 933 bytes (4.46). .data 83 bytes (0.35). No packing indicators.
Code: entire .text = 6a 00 ff 15 74 20 40 00 + int3 padding. Decodes to push 0; call [0x402074] = ExitProcess(0). No branch, no loop, no other call. Every other import unreachable.
Imports (13, all decoy except ExitProcess): injection → VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, OpenProcess. network → InternetOpenA, InternetOpenUrlA, InternetReadFile. persistence → RegCreateKeyExA, RegSetValueExA. execution → CreateProcessA, GetTempPathA. anti-debug → IsDebuggerPresent.
Strings (34 total, both encodings): C2 URL, IE6 UA string, Run key + value WinUpdate, drop path C:\Users\Public\svc.exe, mutex, named pipe, UTF-16 self-delete cmd.exe /c ping -n 3 127.0.0.1 & del "%s", config-placeholder, and literal BENIGN TEST FIXTURE - this program only calls ExitProcess(0).
Resources / overlay / TLS: no resources, no TLS. Overlay 530 bytes at 0xc00: header OVERLAY-TEST-DATA: then bytes 0x00–0xff twice. Entropy 7.98 is byte counter, not crypto.
Absent: no Rich header, no version info, no real config blob. ioc_extract "domain" hit invoice[.]pdb is false positive (PDB filename).

Classification

Verdict: Benign Type: Synthetic test fixture / decoy binary, static surface mimics dropper-trojan Threat: Low Sophistication: Simple Capabilities: none executed. Only ExitProcess(0). Reasoning: Benign needs positive evidence. Here: full code coverage (16 bytes) shows single call to ExitProcess. Network artefacts on reserved test ranges (example.test, 203.0.113.5 TEST-NET-3). Build dir named fixture, mutex/pipe/UA all named "test". Explicit fixture banner string. Imports and strings would trip every heuristic scanner; that is the fixture's point.

Predicted Behavior

Process: starts, exits code 0 immediately. Evidence: entry point code. No child process, no injection (CreateProcessA / CreateRemoteThread imported, never called).
Files: none. Drop path C:\Users\Public\svc.exe string-only.
Registry: none. Run key string-only.
Network: none. WinINet imports and gate.php URL string-only.
Persistence: none.
Evasion: none. IsDebuggerPresent never called.

Initial IOCs (defanged)

File: hashes above · imphash dfcaebd44ff7676285215e9d856415f3 · PDB D:\build\fixture\Release\invoice.pdb Network: hxxp://update-cdn[.]example[.]test/gate[.]php · 203[.]0[.]113[.]5 · UA Mozilla/4.0 (compatible; MSIE 6.0; TestUA/1.0) Host: HKCU\Software\Microsoft\Windows\CurrentVersion\Run → WinUpdate · C:\Users\Public\svc.exe · mutex Global\TestFixtureMutex_9f2a · pipe \\.\pipe\testfixture · cmd.exe /c ping -n 3 127.0.0.1 & del "%s" All string-only; none exercised by code. Do not push to blocklists.

Recommendation

Priority: Low Next phase: Close as Benign. No dynamic analysis; nothing to observe past instant exit. Why: complete code coverage, self-declared fixture, reserved test infrastructure. Useful as false-positive fixture for detection-engineer rule tests if wanted.

State appended to analysis_state.md in repo root. Work dir tests/out/triage_invoice_2024.exe/ holds strings, carved overlay.

5.0 KiB Raw Blame History Unescape Escape