Impact
Classified suspicious samples through static and dynamic indicators.
Impact
Documented anti-analysis behavior and execution preconditions.
Impact
Separated benign automation artifacts from higher-risk malware behaviors.
Deliverables
- Triage checklist
- Indicator extraction scripts
- Evasion and behavior report
Technical Overview
Suspicious binaries and scripts often contain partial indicators, environment checks, staged payload logic, and noisy false leads. The goal was to build a disciplined triage workflow that surfaces useful evidence quickly.
Architecture
flowchart TD
sample_file[Suspicious sample] --> static_scan[Static features]
sample_file --> controlled_run[Controlled execution]
static_scan --> indicators[Indicators]
controlled_run --> observed_behavior[Observed behavior]
observed_behavior --> risk_score[Capability score]
indicators --> risk_score
risk_score --> triage_report[Triage decision]
Model
where T is triage priority, B is observed behavior, E is evasion strength, N is network activity, and P is persistence capability.
Implementation Sketch
def score_sample(features):
weights = {'network': 0.20, 'persistence': 0.15, 'evasion': 0.25, 'behavior': 0.40}
return sum(features.get(k, 0) * w for k, w in weights.items())
if sample.has_vm_check or sample.sleeps_long:
notes.append('anti-analysis gate requires alternate run profile')Engineering Approach
- Start with hash, metadata, strings, imports, and packer indicators.
- Run controlled dynamic tests only after defining expected observations and rollback boundaries.
- Score behavior by capability, reachability, and confidence rather than by isolated suspicious strings.
Results
- Produced concise behavior summaries for suspicious files, web payloads, and scripted malware.
- Identified evasion gates such as VM checks, sleep delays, locale checks, and network reachability tests.
- Made the analysis reproducible through command logs, extracted indicators, and scoped recommendations.
What This Demonstrates
- A reliable triage process values reproducibility over speculation.
- Evasion analysis should document both what executed and what conditions prevented execution.
- Indicator severity is strongest when static and dynamic evidence agree.