Malware analysis and reverse engineering
Sample intelligence, detonation environments and static analysis tooling. What you need to get from “we have something odd” to an indicator the SOC can use.
Before you detonate anything
A sample uploaded to a public service is a published sample. If it came from a client incident it may contain personal data, credentials or organisational identifiers, and uploading it can in itself constitute a notifiable breach. Analyse locally first; the public sandbox is for what is already public.
Samples and intelligence
To find out whether somebody has already seen what you are looking at.
MalwareBazaar
SamplesFrom abuse.ch. A sample repository with family tagging and an open API. It is the field's institutional reference and the sensible alternative to less governed archives.
ThreatFox
IOCsShared indicators of compromise, linked to families. Integrates into MISP with no effort.
URLhaus
DistributionMalware distribution URLs. Useful for cutting the delivery route while it is still live, which is the only window in which it helps.
YARAify
YARAScans files against a public corpus of YARA rules. Saves writing a rule for something already classified.
Malpedia
ReferenceFrom Fraunhofer FKIE. An encyclopaedia of families with bibliography and naming reconciled across vendors. Indispensable when three reports call the same thing three different names.
Detonation
Observed behaviour, with the caveats in the notice above.
ANY.RUN
SandboxAn interactive sandbox: you can click inside the machine while it runs. Irreplaceable for chains that require user interaction, which today is nearly all of them.
Triage
SandboxAutomated analysis with configuration extraction for known families. Requires an account. The config extraction saves hours of manual reversing.
VirusTotal
AggregatorWell known and badly used. The engine verdicts matter little; what matters are the relationships, the behaviour and the distribution telemetry.
Static analysis and reversing
When you have to open it up.
Ghidra
DisassemblerFrom the NSA, free, with a decompiler. It democratised the discipline: what used to need a five-figure licence is now done by a well-directed junior.
Cutter
DisassemblerA front end for rizin. Lighter than Ghidra for a quick look, and enough for most triage.
x64dbg
DebuggerA user-mode Windows debugger. The natural complement when static analysis runs into packing.
CAPA
AutomationFrom Mandiant. Identifies binary capabilities and maps them to ATT&CK. Run it first: within a minute it tells you whether opening the file is worth your time.
FLOSS
StringsExtracts obfuscated strings that `strings` will not see. Surprisingly effective for how little it costs.
YARA
RulesThe standard for describing and hunting families. Writing your own rule and shipping it with the report is the difference between reporting an incident and closing it.
Environments
So you do not build it from scratch every time.
Last reviewed:
Start with the scope
A thirty-minute conversation is enough to determine whether the engagement makes sense, which type fits and what order of magnitude it carries. No cost, no commitment.