Malware Sample Triage Without Execution

Treat an unknown executable, script, or library as hostile. Begin with static metadata in an isolated analysis workspace. Do not run the sample on an operator workstation, disable protections, inject it into a process, or upload client files to public scanning services.

1. Record the sample and its provenance

Use the client-approved evidence path, assign a case ID, and record who supplied the file and when. Preserve the original unchanged. Perform the analysis on a disposable, non-domain-joined VM with no shared folders, credentials, or uncontrolled network access.

2. Hash and identify the file

From a Linux analysis VM:

sha256sum sample.bin
file sample.bin
stat --printf='size=%s bytes\nmodified=%y\n' sample.bin

From Windows, Sysinternals Sigcheck can report file metadata and signature details without executing the target:

sigcheck64.exe -nobanner -a -h -i "C:\Analysis\sample.bin"

Example output:

Verified:       Unsigned
Link date:      2026-08-14 10:22:11
MachineType:    64-bit
MD5:            [omitted]
SHA256:         3D5A...B109

The signature result and file type are leads, not a verdict. Compare hashes against the case evidence record and trusted vendor packages. Do not copy secrets, complete hashes tied to a client, or internal paths into a public report.

3. Extract a small static indicator set

For a quick string review, use a bounded output and keep it local:

strings -a -n 10 sample.bin | head -n 25

Look for expected product names, URLs, file paths, imports, or build metadata. Strings may contain passwords, tokens, personal information, or internal hostnames. Review them locally and redact before sharing. Static strings alone do not demonstrate behavior.

For managed .NET files, use an approved decompiler in the isolated analysis VM to inspect assembly metadata, method names, and native interop declarations. Keep the output in the case workspace. Do not convert the review into runnable loader, injection, or evasion code.

4. Decide whether dynamic analysis is authorized

Dynamic analysis requires a separate approval that defines the isolated environment, network simulation, snapshot/revert plan, data controls, and stop conditions. If approved, capture process, file, registry, and network behavior with the designated sandbox and compare it with the expected test objective. Never connect an unknown sample to a real internal network or production account.

5. Report and dispose

Record source, hash, file type, signature, static observations, analysis limits, and chain of custody. At closeout, follow the evidence-retention decision and sanitize the analysis media under the organization’s approved process.