# Malware Triage Checklist

## Initial Assessment Phase

### File Information Collection
- [ ] Calculate all hashes (MD5, SHA1, SHA256)
- [ ] Document original filename
- [ ] Record file size
- [ ] Identify file type (PE32/PE64/Script/Document/Archive)
- [ ] Note file creation/modification timestamps
- [ ] Check for file signatures (magic bytes)

### Reputation and Context
- [ ] Search hash on VirusTotal
- [ ] Search hash on MalwareBazaar
- [ ] Search hash on Hybrid Analysis
- [ ] Check if file is known good/bad
- [ ] Review AV detection rates
- [ ] Check submission dates and prevalence
- [ ] Review any available sandbox reports

### Quick Static Indicators

#### PE Files
- [ ] Check if file is packed/compressed (high entropy)
- [ ] Identify packer if detected (UPX, ASPack, Themida, etc.)
- [ ] Review PE sections (unusual names, high entropy sections)
- [ ] Check compilation timestamp (realistic or fake)
- [ ] Examine digital signature (signed/unsigned, valid/invalid)
- [ ] Review import table for suspicious APIs
- [ ] Check for overlay data
- [ ] Examine resources (icons, version info, embedded files)

#### Script Files (PowerShell, JavaScript, VBS, etc.)
- [ ] Check for obfuscation
- [ ] Identify encoding methods (Base64, hex, etc.)
- [ ] Look for download/execution commands
- [ ] Check for embedded URLs or IPs
- [ ] Review variable/function names (random = suspicious)

#### Office Documents
- [ ] Check for macros
- [ ] Examine embedded objects/OLE streams
- [ ] Look for external references (templates, links)
- [ ] Check for DDE/equation editor exploits
- [ ] Review document metadata

### Strings Analysis
- [ ] Extract readable strings
- [ ] Look for URLs and IP addresses
- [ ] Identify file paths
- [ ] Find registry keys
- [ ] Check for email addresses
- [ ] Look for error messages or debug strings
- [ ] Identify cryptocurrency wallet addresses
- [ ] Find mutex names
- [ ] Locate service/process names

### Behavior Prediction
Based on initial findings, predict likely behaviors:
- [ ] Network communication expected?
- [ ] File creation/modification expected?
- [ ] Registry changes expected?
- [ ] Process injection expected?
- [ ] Persistence mechanism type?

## Classification Phase

### Malware Type Determination
- [ ] Trojan (general backdoor/RAT)
- [ ] Ransomware (file encryption)
- [ ] Worm (self-propagating)
- [ ] Rootkit (stealth/hiding)
- [ ] Botnet client
- [ ] Infostealer (credentials, browser data)
- [ ] Keylogger
- [ ] Backdoor/RAT
- [ ] Dropper/Loader
- [ ] Cryptominer
- [ ] Adware/PUP
- [ ] Banking trojan
- [ ] Unknown/Hybrid

### Sophistication Assessment
- [ ] Simple (basic functionality, no obfuscation)
- [ ] Moderate (some obfuscation, standard techniques)
- [ ] Advanced (heavy obfuscation, anti-analysis)
- [ ] APT-level (custom, targeted, advanced evasion)

### Threat Level
Based on capabilities and target:
- [ ] Critical (destructive, wide impact)
- [ ] High (data theft, system compromise)
- [ ] Medium (limited functionality, targeted)
- [ ] Low (minimal impact, easily detected)

## Dynamic Analysis Decision

### Should I run dynamic analysis?
**YES, if:**
- Static analysis insufficient for understanding
- Need to confirm predicted behaviors
- Unknown/new sample requiring behavior observation
- Investigating specific functionality
- Creating behavioral signatures

**NO, if:**
- Clearly identified as known malware
- Destructive capabilities too risky
- Time constraints for quick triage
- Static analysis provides sufficient information

### Safe Execution Requirements
If proceeding with dynamic analysis:
- [ ] Isolated VM environment confirmed
- [ ] Network isolation configured (or monitoring ready)
- [ ] Snapshots taken
- [ ] Monitoring tools prepared (Process Monitor, Wireshark, etc.)
- [ ] Host system protected
- [ ] Backup and recovery plan ready

## Priority Assessment

### Immediate Priority (Analyze Now)
- Unknown samples with unclear threat level
- Samples matching recent threat intelligence
- Active incident-related samples
- Samples with destructive capabilities
- Targeted/APT-style malware

### Standard Priority (Normal Queue)
- Known malware variants
- Common commodity malware
- Samples with clear signatures
- Historical samples for research

### Low Priority (Defer if Needed)
- Clearly identified samples
- Adware/PUP with minimal impact
- Old/outdated malware
- Test files or false positives

## Initial Findings Summary Template

Use this template to document triage results:

```
## Triage Summary

**Sample:** [filename]
**Hashes:**
- MD5: [hash]
- SHA1: [hash]
- SHA256: [hash]

**File Type:** [type]
**Size:** [size]
**Packed:** [Yes/No - Packer name]

**Initial Classification:**
- Type: [Malware type]
- Threat Level: [Critical/High/Medium/Low]
- Sophistication: [Simple/Moderate/Advanced]

**Key Indicators:**
- [Notable finding 1]
- [Notable finding 2]
- [Notable finding 3]

**Predicted Behaviors:**
- [Expected behavior 1]
- [Expected behavior 2]

**Recommendation:**
[Proceed with full analysis / Quick report / Defer]

**Priority:** [Immediate/Standard/Low]

**Next Steps:**
1. [Action 1]
2. [Action 2]
```

## Common Triage Pitfalls

### Don't:
- Rush through hash calculation (always get all three)
- Skip online searches (leverage community intelligence)
- Assume packing means malicious (many legitimate software is packed)
- Execute without proper isolation
- Trust timestamps (easily forged)
- Overlook string encoding (Base64, hex, unicode)
- Ignore resource sections (often contain payloads)

### Do:
- Document everything immediately
- Use multiple analysis tools
- Verify findings with different methods
- Consider false positive possibilities
- Check for packer signatures before deep analysis
- Review import table carefully
- Look for anti-analysis techniques
- Consider file context (how obtained, where found)

## Time-Efficient Triage

For efficient time management:

**5-minute triage:**
- Calculate hashes
- Check online databases
- Run strings
- Check packer

**15-minute triage:**
- Above +
- PE header analysis
- Import table review
- Resource examination
- Quick prediction

**30-minute triage:**
- Above +
- Detailed strings analysis
- Preliminary YARA rule concepts
- Behavior prediction writeup
- Classification and prioritization

## Tools Quick Reference

**Hash Calculation:**
- `scripts/hash_calculator.py`
- CertUtil (Windows): `certutil -hashfile file.exe SHA256`
- sha256sum (Linux): `sha256sum file.exe`

**Online Databases:**
- VirusTotal: virustotal.com
- MalwareBazaar: bazaar.abuse.ch
- Hybrid Analysis: hybrid-analysis.com
- Any.Run: any.run

**Static Analysis:**
- PE analysis: pestudio, PEview, CFF Explorer
- Strings: strings.exe, FLOSS
- Hex editor: HxD, 010 Editor
- Packer detection: Detect It Easy (DIE), Exeinfo PE

**Quick Sandboxing:**
- Any.Run (interactive)
- Hybrid Analysis
- Joe Sandbox
- Cuckoo (self-hosted)