Other information, such as the file name, size, and so on, are easily gathered using native Windows and/or Linux/Unix tools. This is where various data sources such as proxy, dns, firewall, process auditing (e.g. If you don’t get lucky, however, you might need to investigate to figure out where the malware came from and how it got delivered. Maybe it was an executable dropped by a malicious word document phish with the subject line xxx from e-mail address yyy, or it was a payload from a remote execution campaign, or it was an implant dropped from a backdoor or webshell. Occasionally, you might get lucky and get information on how the sample was obtained.

We’ll go ahead and walk through how to answer each of these questions. Most of the time, getting these answers won’t require executing the malware, but you may use a variety of tools, scripts, or third party resources. Linux ELF, shared object (SO), windows PE executable (exe), shared library (.dll), etc.), what functionality does it import? Is it cryptographically signed? Does it define a PDB path? What are the file hashes for this file?.What is the file size and file extension?.Malware triage attempts to answer basic questions about a file sample: Any malicious artifacts that you are attempting to analyze should be treated with care at all times, even if you believe they aren’t particularly dangerous. These systems should be segmented and separated away from the rest of your systems, with no way to connect to systems on your production networks. Always analyze malware on dedicated malware analysis systems and/or virtual machines.

Pestudio linux