Cyberlium

Malware › Module 3 › Lesson 1

BeginnerModule 3Lesson 1/5

Static Workflow

Static workflow: hash, type, strings, headers — triage before any $MAL_LAB detonation with legally sourced samples.

15 min+40 XP3 quiz
Module progress1 of 5

Visual · mal_static_workflow

Static workflow literacy. $MAL_LAB only. Original Cyberlium.

Opening

Static workflow answers 'what is this file?' before you ask 'what does it do?' in sandbox.

Professional static workflow: obtain sample with provenance → sha256 hash → identify file type → extract strings and metadata → PE/ELF header review → decide if dynamic analysis on $MAL_LAB is warranted. Document each step in analysis notes for reproducibility. Cyberlium teaches workflow literacy on copies analyzed on daily driver ONLY for non-execution tools (hash, strings) — executables still detonate only on $MAL_LAB. Next: File Triage.

1. Workflow steps in order

1) Log source and sha256. 2) file/trid magic bytes. 3) strings and entropy note. 4) PE/ELF headers if applicable. 5) YARA scan (later module). 6) Dynamic decision gate — only then $MAL_LAB sandbox.

Skipping steps wastes sandbox time and risks detonating benign-looking packed binaries without context.

Command guide

Try these commands — Workflow steps in order

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Linux file(1) — https://man7.org/linux/man-pages/man1/file.1.html (magic bytes literacy) Microsoft PE format — https://learn.microsoft.com/en-us/windows/win32/debug/pe-format (Windows binary literacy)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Use WSL or install file for Windows Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal
python3 <<'PY' > "$HOME/cyberlium-lab/t22-mal/samples/demo_toy.py"
#!/usr/bin/env python3
print('benign lab script — not malware')
PY

Command — copy this

chmod +x "$HOME/cyberlium-lab/t22-mal/samples/demo_toy.py"
file "$HOME/cyberlium-lab/t22-mal/samples/demo_toy.py"
file "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt"

Primary tools to practice this lesson: file, python3. Reference sites: Linux file(1) (https://man7.org/linux/man-pages/man1/file.1.html); Microsoft PE format (https://learn.microsoft.com/en-us/windows/win32/debug/pe-format). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Documentation and reproducibility

Each step gets timestamp, tool version, and output path in chmod 600 notes. Analysts share reports with hashes and IOCs — not live binaries in chat.

Your $MAL_LAB workflow template becomes the spine for Modules 3–4 labs.

3. Static on host vs execute in guest

Hash and strings on a read-only copy from host is common — but treat executables as radioactive: no double-click, no 'open with.' Execution stays on $MAL_LAB only.

Ship: numbered static workflow checklist for YOUR lab. Next: File Triage.

4. What you ship: static workflow checklist for $MAL_LAB

Numbered steps from hash to dynamic gate. Host vs guest rules. $MAL_LAB named. chmod 600.

5. What you record before the next lesson

Date. Static workflow checklist. $MAL_LAB named. File t22-m03-l01-static-workflow.txt chmod 600.

6. Wrong vs right: live malware on daily driver vs sandbox

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

  • Wrong

    Skip hashing and detonate immediately. Run.exe on host because 'static needs it.'

  • Right

    Write static workflow checklist. Next: File Triage.

Mission: draft YOUR static workflow

1) List six workflow steps in order. 2) Note host-safe vs guest-only steps. 3) chmod 600. Never skip provenance logging.

Stuck? Ask Cyberlium AI Mentor

Workflow beats heroic one-off clicks.

Knowledge Check

1

APPLY: Static workflow on Cyberlium starts with:

Multiple choice

Knowledge Check

2

APPLY: True or False: Dynamic analysis should run before any static triage.

True or False

Knowledge Check

3

APPLY: Executables should detonate only on:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)