_
This page documents my personal malware triage workflow.
Triage is not full reverse engineering.
It is a structured process used to understand intent, behavior, and risk before deciding how deep analysis should go.
This methodology prioritizes safety, hypothesis-driven analysis, and behavioral confirmation.
_
1. Environment Preparation & Snapshot
Before interacting with a sample, I ensure the analysis environment is isolated and reproducible.
- Offline virtual machine
- Shared folders & clipboard disabled
- Snapshot taken before any analysis
This allows safe rollback and prevents environmental contamination.
2. Static Analysis (Basic → Advanced)
I begin with full static analysis to understand structure and intent without execution.
- File metadata & hashes
- PE structure, imports, sections
- Strings & encoded data
- Anti-analysis indicators
- Suspicious APIs & execution flow
This phase builds a mental model of how the malware is expected to behave.
3. Analyst Notes & Observation
Throughout static analysis, I document:
- Suspected capabilities
- Execution guards or checks
- Interesting functions & code paths
- Indicators worth validating dynamically
4. Hypothesis Formation
Before execution, I define a clear hypothesis based on static findings.
Examples:
- Sample acts as a loader rather than a final payload
- Payload decrypts only after anti-debug checks
- Persistence is registry-based, not service-based
Dynamic analysis is then used to test these assumptions.
5. Dynamic Analysis (Basic → Advanced)
Execution is performed in controlled stages:
- Minimal detonation (initial behavior)
- Monitored execution (file, registry, process)
- Network observation (if applicable)
- Memory inspection and artifact extraction
Deviations from the hypothesis are treated as high-value insights.
6. Validation & Classification
The final stage of triage answers:
- What type of malware is this?
- What capabilities are confirmed?
- How risky is the sample?
- Is deeper reverse engineering required?
Triage ends with a decision — not with exhaustion.
_
