# Malware Triage

> Safely triage unknown malware samples — static indicators, sandbox execution, behavior extraction, and reporting. Use when analyzing suspicious files during investigations.

- Skill: `securityskills/malware-triage` (Agent Skill)
- Install (CLI): `npx skillmds@latest add securityskills/malware-triage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/securityskills/malware-triage/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: securityskills (https://skillmd.com/u/securityskills)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/securityskills/malware-triage

---


# Malware Triage

Analyze suspicious samples safely and extract actionable indicators fast.

## Safety First

- Isolated VM or dedicated sandbox (Cuckoo/ANY.RUN/vendor sandbox), network simulated or sinkholed
- Samples stored in password-protected archives, hash-named; never opened on analysis-adjacent hosts
- Work from snapshots; revert after every detonation

## 1. Static Triage

- Hashes (MD5/SHA256), file type, entropy (`file`, `pestudio`-style overview)
- Strings: URLs, mutexes, registry paths, PDB paths, C2 patterns
- PE specifics: imports of interest (network, process injection, crypto APIs), digital signature validity, packer detection (entropy + section names)
- Document metadata (Office macros, embedded objects, remote templates)

## 2. Dynamic Detonation

- Execute in sandbox with monitoring: file, registry, network, process activity
- Capture: dropped files, persistence mechanism, C2 beacons (domains/IPs with ports/protocols)
- Trigger-dependent malware: require user interaction simulation, geo/fate checks, or debugger awareness — escalate to debugging if silent

## 3. Behavior Extraction

- Persistence: Run keys, services, scheduled tasks, WMI subscriptions
- Injection: process hollowing, APC, SetWindowsHookEx targets
- Exfiltration: DNS tunneling patterns, HTTP POST shapes, known protocol beacons
- Defense evasion: AV service stops, AMSI/ETW patching, timestamp manipulation

## 4. Classification and Reporting

- Family attribution via YARA rules against sample set; note confidence
- Map observed behavior to ATT&CK techniques
- Produce: IOCs (machine-readable, STIX if required), detection guidance (YARA + behavioral), and a one-page triage summary

## Escalation Criteria

Deep-dive reversing (IDA/Ghidra) only when: C2 protocol reconstruction, config extraction, or unpacking is required for detection/response — not for curiosity.