Chapter 31 — Digital forensics and malware analysis: advanced cases
Lesson map
Lesson 31 published. Map, example, EX091.
flowchart TD
N0["Learning outcomes"]
N1["31.1 Static triage"]
N2["31.2 Strings"]
N3["Lab — strings from a synthetic blob"]
N4["31.3 Reading the result"]
N5["31.4 Pivoting"]
N6["31.5 When to escalate"]
N7["31.6 Safe handling"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX091"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["31.1 Static triage"]
N2["31.2 Strings"]
N3["Lab — strings from a synthetic blob"]
N4["31.3 Reading the result"]
N5["31.4 Pivoting"]
N6["31.5 When to escalate"]
N7["31.6 Safe handling"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX091"]
[Learning outcomes]
|
v
[31.1 Static triage]
|
v
[31.2 Strings]
|
v
[Lab — strings from a synthetic blob]
|
v
[31.3 Reading the result]
|
v
[31.4 Pivoting]
|
v
[31.5 When to escalate]
|
v
[31.6 Safe handling]
|
v
[Worked example] --> [Exercise EX091]
Learning outcomes
You will (1) perform safe static triage of a suspicious file; (2) extract strings; (3) relate strings to other evidence; (4) know when to hand over to specialist analysis.
31.1 Static triage
Static analysis examines a file without running it. Sikorski and Honig (2012) start with hashes, file type, strings and headers. Students do this only on synthetic samples in the isolated lab.
Triage answers quick questions that shape what comes next: is the file an executable, is it already known by hash, does it contain obvious indicators such as domains? For update.dll, the hash matched a threat-intelligence entry and the header confirmed a Windows executable. The strings step, shown in the lab, gave the clues that linked the file to the download domain and the run key, all without executing a single instruction.
31.2 Strings
Printable sequences inside a binary can reveal domains, registry paths, messages and user-agent strings. They are clues: packers and encryption can hide strings, and authors can plant misleading ones.
Because strings can be planted, each one is treated as a lead to check against other evidence. A domain found in strings means something only when the proxy log shows the host contacting it. If update.dll were packed, the strings step might return little beyond library names, which would itself be a finding suggesting the need for specialist analysis. Leah records the minimum length used, six characters here, so the result can be reproduced.
Lab — strings from a synthetic blob
"""Extract printable ASCII strings (>=6 chars) from a synthetic blob."""
import re
blob = (b"\x00\x13MZ\x90" + b"\x00" * 20 + b"cdn-update.example.org\x00\x7f\x01"
+ b"Software\\Synthetic\\Run\x00\x02\x03" + b"\xff" * 8 + b"user-agent: SampleBot/1.0\x00")
for s in re.findall(rb"[\x20-\x7e]{6,}", blob):
print(s.decode())
Run with python3 lab_strings.py. Verified output:
cdn-update.example.org
Software\Synthetic\Run
user-agent: SampleBot/1.0
31.3 Reading the result
The synthetic blob carries the MZ executable-format marker (two bytes in here; a real Windows executable starts with it) and yields three strings of six or more characters: cdn-update.example.org, Software\Synthetic\Run, and user-agent: SampleBot/1.0. The domain matches the download indicator; the registry-style path resembles the persistence location; the user-agent gives a new indicator to search for in proxy logs.
The registry path in the sample is synthetic and does not exactly match the run key found on ws-114, which shows why strings are compared with artefacts rather than taken at face value.
31.4 Pivoting
Searching proxy logs for the user-agent "SampleBot/1.0" across all hosts tests whether other machines run the same sample — even if they contacted different domains.
A pivot uses one finding to search for others. If the attacker had sent other hosts to a different download domain, the domain search would miss them, but the same sample would still send the same user-agent. The worked example shows the result: only ws-114. Leah records the pivot as a separate search with its own time range and count, so readers can see it was a distinct test of Q4 rather than a repeat of the domain search.
31.5 When to escalate
Understanding full behaviour may need dynamic analysis or reverse engineering by specialists in a contained lab. Students record what static triage shows and pass the sample on.
Knowing where one's competence ends is part of the method. Leah's static triage answers whether update.dll is executable, known and linked to the indicators; it cannot say what data the DLL might collect or send. Recording that limit and passing the sample to specialists keeps the report accurate. Q2's answer in Laboratory II reflects this: persistence shown, full behaviour pending.
31.6 Safe handling
Samples stay in protected archives on the isolated VM; no execution outside approved sandboxes.
Even a synthetic sample is handled as if it were real, so the habit is in place when real samples appear. The archive password follows the lab's convention so other analysts can open it in the sandbox. Each transfer of the sample is logged like any evidence. If an archive had to leave the lab, it would go only to an approved analysis service, with the transfer recorded.
31.7 Reporting
Strings are reported as "present in the file", not as proof of behaviour.
A string such as a domain shows that the file contains that text; it does not show that the program contacts it, or when. The report pairs each string with any corroborating evidence, such as the proxy GET of /a.bin from cdn-update.example.org at 09:31:02. Strings without corroboration are listed as unconfirmed leads, so readers do not mistake presence for proven behaviour. The user-agent string is reported the same way until the pivot search confirms it.
Worked example
The user-agent search across the full proxy log returns only ws-114, consistent with the earlier indicator search. Leah records the pivot and result, adding the user-agent to the shared indicator list.
Synthetic case. The blob is synthetic, not real malware.
Errors and limits
A string's presence does not mean the code uses it; behaviour must be confirmed by further analysis.
Exercises
- EX091 — Lab strings. List the three strings and one use for each. Rubric: 3 = domain (matches IOC), Run path (persistence), user-agent (new search); 2 = two; 1 = one; 0 = none.
- EX092 — String caution. Why are strings only clues? Rubric: 3 = packing hides, authors plant, presence ≠ use; 2 = partial; 1 = always reliable; 0 = none.
- EX093 — User-agent pivot. What does the user-agent search test? Rubric: 3 = other hosts running same sample even with different domains; 2 = partial; 1 = vague; 0 = none.
Synthesis
Safe static triage yields clues and new indicators; behaviour claims need deeper analysis.
Continue studying — chapter 31 of 40
← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →