File Triage
File triage identifies type, entropy, and anomalies — prioritize $MAL_LAB dynamic queue without executing unknowns on host.
Visual · mal_file_triage
File triage literacy. $MAL_LAB only. Original Cyberlium.
Triage tells you whether you're looking at a document, script, packed PE, or junk — before sandbox time.
File triage uses magic bytes, extensions vs real type mismatches, entropy hints (possible packing), and size anomalies. Tools like file, trid, and peid (literacy names) support classification. Mismatch — invoice.pdf.exe — is a social-engineering cue for analysts, not a launch instruction on host. Cyberlium teaches triage on legally sourced samples with execution deferred to $MAL_LAB. Next: PE/ELF Named.
1. Type identification and mismatch
Magic bytes trump extension — PE starts with MZ, ELF with \x7fELF, PDF with %PDF. Extension mismatch flags social engineering in IR reports.
Record declared type vs observed type in triage table for $MAL_LAB sample queue.
Command guide
Try these commands — Type identification and mismatch
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
EICAR hex view — https://www.eicar.org/ (recognize test string in hex) Hybrid Analysis file details — https://www.hybrid-analysis.com/ (static triage literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in
macOS: Built-in
Windows: Use WSL or install file for Windows
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal xxd "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" | head -4 xxd "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" | grep -i eicar || xxd "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" | tail -1
Primary tools to practice this lesson: file. Reference sites: EICAR hex view (https://www.eicar.org/); Hybrid Analysis file details (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Entropy and packing hints
High entropy sections may indicate compression or encryption — common in packed malware. Triage note: 'possible packer — static strings sparse, dynamic warranted on $MAL_LAB.'
Entropy alone is not proof of malice — but it prioritizes sandbox and unpacker literacy later.
3. Triage output feeds priority queue
Output: priority (high/medium/low), recommended next static tools, dynamic Y/N for $MAL_LAB. Never triage by executing on daily driver.
Ship: triage table columns — sha256, declared type, observed type, entropy note, dynamic Y/N. Next: PE/ELF Named.
4. What you ship: file triage table template
Columns: hash, declared/observed type, entropy note, dynamic gate. $MAL_LAB queue. chmod 600.
5. What you record before the next lesson
Date. Triage table template. $MAL_LAB named. File t22-m03-l02-file-triage.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Trust extension only. Run file to 'see what happens' by executing.
- Right: Write triage table template. Next: PE/ELF Named.
Mission: create triage table template
1) Define triage columns. 2) Write extension mismatch example line. 3) Note dynamic gate to $MAL_LAB. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Mismatch extensions are social engineering signals — log them.
APPLY: File triage on Cyberlium uses:
APPLY: True or False: File extension always matches true file type.
APPLY: High entropy in a PE section may suggest:
PE ELF Named
Part of Malware Analysis with AI — Static Analysis Basics.
Lab — Static
Part of Malware Analysis with AI — Static Analysis Basics.
Quiz — Static
Part of Malware Analysis with AI — Static Analysis Basics.