Static Workflow
Static workflow: hash, type, strings, headers — triage before any $MAL_LAB detonation with legally sourced samples.
Visual · mal_static_workflow
Static workflow literacy. $MAL_LAB only. Original Cyberlium.
Static workflow answers 'what is this file?' before you ask 'what does it do?' in sandbox.
Professional static workflow: obtain sample with provenance → sha256 hash → identify file type → extract strings and metadata → PE/ELF header review → decide if dynamic analysis on $MAL_LAB is warranted. Document each step in analysis notes for reproducibility. Cyberlium teaches workflow literacy on copies analyzed on daily driver ONLY for non-execution tools (hash, strings) — executables still detonate only on $MAL_LAB. Next: File Triage.
1. Workflow steps in order
1) Log source and sha256. 2) file/trid magic bytes. 3) strings and entropy note. 4) PE/ELF headers if applicable. 5) YARA scan (later module). 6) Dynamic decision gate — only then $MAL_LAB sandbox.
Skipping steps wastes sandbox time and risks detonating benign-looking packed binaries without context.
Command guide
Try these commands — Workflow steps in order
═══ LINUX / macOS (Static Triage) ═══
Calculate cryptographic hashes (SHA-256 and MD5) for malware sample triage
Command — copy this
sha256sum sample.bin 2>/dev/null || echo "Compute SHA-256 with sha256sum" md5sum sample.bin 2>/dev/null || echo "Compute MD5 with md5sum"
Identify file type and executable architecture
Command — copy this
file sample.bin 2>/dev/null || xxd -g 1 -l 16 sample.bin
Extract printable ASCII and Unicode strings (look for URLs, IPs, C2 indicators)
Command — copy this
strings -a -n 8 sample.bin 2>/dev/null | grep -iE "(http|https|powershell|cmd|\.dll|\.exe|temp|appdata)" | head -20
═══ WINDOWS (POWERSHELL) ═══ Get file hash in PowerShell
Command — copy this
Get-FileHash -Algorithm SHA256 .\sample.bin
Primary tools to practice this lesson: file, python3. Reference sites: Linux file(1) (https://man7.org/linux/man-pages/man1/file.1.html); Microsoft PE format (https://learn.microsoft.com/en-us/windows/win32/debug/pe-format). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Documentation and reproducibility
Each step gets timestamp, tool version, and output path in chmod 600 notes. Analysts share reports with hashes and IOCs — not live binaries in chat.
Your $MAL_LAB workflow template becomes the spine for Modules 3–4 labs.
3. Static on host vs execute in guest
Hash and strings on a read-only copy from host is common — but treat executables as radioactive: no double-click, no 'open with.' Execution stays on $MAL_LAB only.
Ship: numbered static workflow checklist for YOUR lab. Next: File Triage.
4. What you ship: static workflow checklist for $MAL_LAB
Numbered steps from hash to dynamic gate. Host vs guest rules. $MAL_LAB named. chmod 600.
5. What you record before the next lesson
Date. Static workflow checklist. $MAL_LAB named. File t22-m03-l01-static-workflow.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Skip hashing and detonate immediately. Run.exe on host because 'static needs it.'
- Right: Write static workflow checklist. Next: File Triage.
Mission: draft YOUR static workflow
1) List six workflow steps in order. 2) Note host-safe vs guest-only steps. 3) chmod 600. Never skip provenance logging.
Stuck? Ask Cyberlium AI Mentor
Workflow beats heroic one-off clicks.
APPLY: Static workflow on Cyberlium starts with:
APPLY: True or False: Dynamic analysis should run before any static triage.
APPLY: Executables should detonate only on:
File Triage
Part of Malware Analysis with AI — Static Analysis Basics.
PE ELF Named
Part of Malware Analysis with AI — Static Analysis Basics.
Lab — Static
Part of Malware Analysis with AI — Static Analysis Basics.