Malware › Module 3 › Lesson 1
Static Workflow
Static workflow: hash, type, strings, headers — triage before any $MAL_LAB detonation with legally sourced samples.
Visual · mal_static_workflow
Static workflow literacy. $MAL_LAB only. Original Cyberlium.
Opening
Static workflow answers 'what is this file?' before you ask 'what does it do?' in sandbox.
Professional static workflow: obtain sample with provenance → sha256 hash → identify file type → extract strings and metadata → PE/ELF header review → decide if dynamic analysis on $MAL_LAB is warranted. Document each step in analysis notes for reproducibility. Cyberlium teaches workflow literacy on copies analyzed on daily driver ONLY for non-execution tools (hash, strings) — executables still detonate only on $MAL_LAB. Next: File Triage.
1. Workflow steps in order
1) Log source and sha256. 2) file/trid magic bytes. 3) strings and entropy note. 4) PE/ELF headers if applicable. 5) YARA scan (later module). 6) Dynamic decision gate — only then $MAL_LAB sandbox.
Skipping steps wastes sandbox time and risks detonating benign-looking packed binaries without context.
Command guide
Try these commands — Workflow steps in order
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Linux file(1) — https://man7.org/linux/man-pages/man1/file.1.html (magic bytes literacy) Microsoft PE format — https://learn.microsoft.com/en-us/windows/win32/debug/pe-format (Windows binary literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Use WSL or install file for Windows Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal
python3 <<'PY' > "$HOME/cyberlium-lab/t22-mal/samples/demo_toy.py"
#!/usr/bin/env python3
print('benign lab script — not malware')
PYCommand — copy this
chmod +x "$HOME/cyberlium-lab/t22-mal/samples/demo_toy.py" file "$HOME/cyberlium-lab/t22-mal/samples/demo_toy.py" file "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt"
Primary tools to practice this lesson: file, python3. Reference sites: Linux file(1) (https://man7.org/linux/man-pages/man1/file.1.html); Microsoft PE format (https://learn.microsoft.com/en-us/windows/win32/debug/pe-format). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Documentation and reproducibility
Each step gets timestamp, tool version, and output path in chmod 600 notes. Analysts share reports with hashes and IOCs — not live binaries in chat.
Your $MAL_LAB workflow template becomes the spine for Modules 3–4 labs.
3. Static on host vs execute in guest
Hash and strings on a read-only copy from host is common — but treat executables as radioactive: no double-click, no 'open with.' Execution stays on $MAL_LAB only.
Ship: numbered static workflow checklist for YOUR lab. Next: File Triage.
4. What you ship: static workflow checklist for $MAL_LAB
Numbered steps from hash to dynamic gate. Host vs guest rules. $MAL_LAB named. chmod 600.
5. What you record before the next lesson
Date. Static workflow checklist. $MAL_LAB named. File t22-m03-l01-static-workflow.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip hashing and detonate immediately. Run.exe on host because 'static needs it.'
Right
Write static workflow checklist. Next: File Triage.
Mission: draft YOUR static workflow
1) List six workflow steps in order. 2) Note host-safe vs guest-only steps. 3) chmod 600. Never skip provenance logging.
Stuck? Ask Cyberlium AI Mentor
Workflow beats heroic one-off clicks.
Knowledge Check
APPLY: Static workflow on Cyberlium starts with:
Multiple choice
Knowledge Check
APPLY: True or False: Dynamic analysis should run before any static triage.
True or False
Knowledge Check
APPLY: Executables should detonate only on:
Multiple choice