Legal Samples
Legal sample sourcing chain — intentional lab malware, repositories, instructor manifests; refuse mystery USB and breach dumps.
Visual · t22_legal_samples
Legal samples = documented source chain. $MAL_LAB. Original Cyberlium.
Where the sample came from matters as much as what it does — mystery binaries are someone else's incident waiting to happen.
Legal malware analysis uses samples with documented provenance: instructor-provided manifests, authorized malware repositories (MalwareBazaar research use, lab curriculum packages), your own intentionally crafted benign EICAR-class or custom lab binaries per brief — each with hash, source URL or mentor ID, and license/use terms. Refused sources: random email attachments, unknown USB, scraped stranger breach archives, 'friend sent me this exe,' torrent pirated software as malware stand-in without chain. Chain of custody note: UTC received, hash verified, stored chmod 600 in $HOME/cyberlium-lab/samples vault — never execute without manifest match. Legal clarity protects you if behavior crosses lines — mystery sample means stop, do not detonate.
1. Allowed source classes
Curriculum manifest, authorized research repo with ToS read, instructor signed package, self-built lab binary per assignment.
Hash must match manifest before $MAL_LAB detonation — mismatch means stop.
Command guide
Try these commands — Allowed source classes
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: curl, grep. Reference sites: MalwareBazaar about (https://bazaar.abuse.ch/about/); VirusTotal acceptable use (https://www.virustotal.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Refused sources
Unknown USB, phishing attachments, dark web markets, employer prod quarantine without IR authorization in writing.
Breach dump executables without legal review — often illegal to possess or analyze outside IR scope.
3. Chain of custody
Log: source ID, SHA256, UTC stored, analyst name, $MAL_LAB VM used, revert Y/N after run.
chmod 600 vault — no cloud sync of live samples folder to personal Drive.
4. What you ship: sample sourcing chain card
Allowed sources list + refused sources + custody log fields + hash-verify rule.
5. What you record before the next lesson
Sample sourcing chain path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Detonate unknown exe from Discord because 'good practice sample.'
- Right: Sample sourcing chain documented. Next: No Weaponize.
Mission: sample sourcing chain
1) List four allowed source classes. 2) List five refused sources. 3) Custody log field list. 4) Hash-verify before detonate rule.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “MalwareBazaar download — lab policy?”
APPLY: Legal sample requires:
APPLY: True or False: Mystery email attachment is valid lab sample.
APPLY: Before detonation verify:
No Weaponize
Part of Malware Analysis with AI — Safe Handling and Ethics.
Lab — Ethics Notes
Part of Malware Analysis with AI — Safe Handling and Ethics.
Quiz — Ethics
Part of Malware Analysis with AI — Safe Handling and Ethics.