Lab — Static
Pack static literacy — workflow, triage, PE/ELF — literacy file only, dest $MAL_LAB.
Visual · mal_static_lab
Lab: write static pack. $MAL_LAB only. Original Cyberlium.
Static pack before sandbox — workflow and triage on paper first.
Lessons 3-1 through 3-3 covered static workflow, file triage, and PE/ELF naming. This lab merges them into one static literacy pack for $MAL_LAB with optional hash-only exercise on a legal training sample metadata. No detonation required — static paperwork first. Next: Quiz — Static Analysis Basics.
1. Lab contract: write the static pack
Create $HOME/cyberlium-lab/t22-m03-l04-static-lab.txt merging workflow checklist, triage table template, PE/ELF comparison, and link to M1 mindset pack.
Optional: fill triage row for a MalwareBazaar hash you looked up — metadata only, no host execution.
Command guide
Try these commands — Lab contract: write the static pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Static triage workflow — https://malwareunicorn.org/workshops/malwareanalysis101.html ANY.RUN static view — https://any.run/ (metadata literacy from public reports) Microsoft PE — https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in
macOS: Built-in
Windows: Use WSL or install file for Windows
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal file "$HOME/cyberlium-lab/t22-mal/samples/"* xxd "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" | head -3 wc -l "$HOME/cyberlium-lab/t22-mal/samples/demo_toy.py" "$HOME/cyberlium-lab/t22-mal/samples/demo_bin.sh"
═══ WINDOWS ═══
Command — copy this
Get-ChildItem $HOME/cyberlium-lab/t22-mal/samples/ | Select-Object Name, Length
Primary tools to practice this lesson: file. Reference sites: Static triage workflow (https://malwareunicorn.org/workshops/malwareanalysis101.html); ANY.RUN static view (https://any.run/); Microsoft PE (https://learn.microsoft.com/en-us/windows/win32/debug/pe-format). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check execution shortcuts
Grep for host.exe launch, skipped hash steps, or daily driver paths — fix. Tutorials that jump straight to sandbox get workflow prepended for $MAL_LAB.
Classmates write their own static packs.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Strings and Hashing.
Static pack feeds hashing and strings module.
4. What you ship: static analysis literacy pack for $MAL_LAB
Workflow + triage + PE/ELF merged. $MAL_LAB named. No host detonation. chmod 600.
5. What you record before the next lesson
Date. Static pack path. $MAL_LAB named. File t22-m03-l04-static-lab.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Skip pack and detonate on laptop. Omit dynamic gate line.
- Right: Write YOUR static pack for $MAL_LAB. chmod 600. Next: Quiz — Static Analysis Basics.
Mission: freeze YOUR static pack on disk
1) Merge M3 literacy sections. 2) Link M1 mindset pack path. 3) chmod 600. Never authorize host execution.
Stuck? Ask Cyberlium AI Mentor
Static packs make sandbox time purposeful.
APPLY: This lab requires:
APPLY: True or False: Static pack should include dynamic gate to $MAL_LAB.
APPLY: PE/ELF section in pack is for: