Triage Checklist for Unknown Binaries

A safe, static analysis workflow before detonating a suspicious file in a sandbox.

1. Isolate and Hash

Ensure the file is on a disconnected analysis machine. Generate MD5, SHA-1, and SHA-256 hashes. Query VirusTotal or ThreatFox with the hash to see if it's a known threat.

2. Verify Magic Number

Do not trust the extension. Use file or our MIME Sniffer to check the header signature.

3. Extract Strings

Dump ASCII and Unicode strings. Look for:

• IP addresses or domain names (C2 infrastructure).
• API calls (e.g., VirtualAlloc, URLDownloadToFile).
• Registry keys or file paths used for persistence.

4. Measure Entropy

Calculate Shannon entropy. If the entropy is > 7.5 bits/byte, the file is likely packed (e.g., UPX) or encrypted, meaning static string analysis will fail until it's unpacked.

5. Inspect Headers (if PE/ELF)

Check the compile timestamp. Look for abnormal section names (e.g., .upx0). Check the import table for suspicious DLLs.