File Static Triage

Analyzing suspicious files manually is slow and dangerous. This skill provides a systematic framework for triaging potential malware using static analysis techniques, ensuring you identify threats without ever executing malicious code.

What it does

• Multi-algorithm hashing generates MD5, SHA1, SHA256, and fuzzy hashes like ssdeep or TLSH for threat intelligence lookups.
• Deep PE analysis inspects compile times, section permissions, packers, and imports grouped by malicious behavior like credential theft or evasion.
• Document inspection extracts VBA macros, auto-exec entry points, and remote templates from Office files and PDFs.
• Script deobfuscation identifies download cradles, AMSI bypasses, and Windows Defender tampering in PowerShell, VBS, and JS.
• Verdict scoring calculates a risk score from 0 to 60+ based on heuristics like entropy, magic bytes, and MITRE ATT&CK mapping.

How to work

1. Initialize analysis by running the triage script against a single file or a directory of samples.
2. Review the verdict to see the calculated risk score and the top three technical reasons for the classification.
3. Map behaviors to MITRE ATT&CK techniques based on identified strings, APIs, and file structures.
4. Export findings into a JSON report for integration with EDR or threat intel platforms.

Frameworks & tools

The skill utilizes python3 with pefile for header analysis, ssdeep and python-tlsh for similarity matching, and focuses on MITRE ATT&CK alignment.

Why this beats prompting it yourself

Generic LLM prompts often miss subtle indicators like imphashes or specific PE section characteristics. This skill enforces a strict safety protocol and a weighted scoring system that ensures consistent, repeatable verdicts backed by actual file telemetry.

Use cases

• Triage suspicious email attachments or web downloads before detonation.
• Analyze obfuscated PowerShell scripts found in system logs.
• Identify packed or signed-but-malicious binaries during incident response.
• Generate technical summaries and ATT&CK mappings for SOC reports.

Known limitations

Analysis is strictly static and does not account for runtime behavior or multi-stage payloads downloaded after execution. Requires an isolated analysis environment.