Malware Classification

Systematic methodology for triaging unknown binaries, classifying malware families, extracting indicators of compromise, and producing actionable intelligence. Covers the full pipeline from initial sample receipt through final classification report.

Classification Taxonomy

Know what you are looking for. Every sample maps to one of these categories:

Triage Workflow

Follow this sequence. Each phase feeds the next — do not skip steps.

Phase 1 — Sample Receipt and Hashing

Every analysis begins with positive identification and deduplication.

# Compute all hashes for the sample
sha256sum <sample>
md5sum <sample>
ssdeep <sample>

# Check file type
file <sample>

# Track in romero analysis DB
node ${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js hash <sample>
node ${CLAUDE_PLUGIN_ROOT}/scripts/analysis-tracker.js add <sha256> classification pending

Record SHA256, MD5, SHA1, ssdeep, file size, and file type before touching anything else. This is your chain of custody starting point.

Phase 2 — Static Triage (No Execution)

Static analysis extracts maximum intelligence without running the sample.

2a. PE Header Analysis

# Section table, imports, exports, timestamps, debug info
r2 -qc 'iH; iS; ii; iE; it' <sample>

# Rich header (compiler fingerprint)
r2 -qc 'iR' <sample>

# Check for anomalies with pestudio (if available)
pestudio <sample>

Look for: abnormal section names (packer signatures), section entropy above 6.5, entry point outside .text, minimal imports (LoadLibrary + GetProcAddress only), mismatched compile timestamps, suspicious rich header entries.

2b. Packer and Protector Detection

# Detect It Easy — best automated packer identification
diec <sample>

# YARA-based packer scan
yara -r ${CLAUDE_PLUGIN_ROOT}/rules/packers.yar <sample>

# Entropy per section (key packer signal)
r2 -qc 'iS~entropy' <sample>

If packed: identify the packer, attempt unpacking, then restart triage on the unpacked sample. See references/packer-detection.md for packer-specific strategies.

2c. String Extraction

# Standard strings
strings -n 6 <sample> > strings_ascii.txt
strings -n 6 -el <sample> > strings_unicode.txt

# FLOSS for obfuscated/stack strings
floss <sample> > strings_floss.txt

# Quick triage of interesting strings
strings <sample> | grep -iE '(http|ftp|\.exe|\.dll|cmd\.exe|powershell|reg\s|schtasks|net\s|wmic)'

Strings reveal: C2 URLs, file paths, registry keys, mutex names, error messages, API names, embedded configs, debug paths (PDB), campaign IDs.

2d. Import Analysis

# Full import table
r2 -qc 'ii' <sample>

# Compute imphash for family clustering
python3 -c "import pefile; pe=pefile.PE('<sample>'); print(pe.get_imphash())"

Flag these import categories:

2e. YARA Scanning

# Scan against all rule sets
yara -s -r /path/to/rules/ <sample>

# Scan with specific rulesets
yara -s rules/malware_families.yar <sample>
yara -s rules/capabilities.yar <sample>
yara -s rules/packers.yar <sample>

See references/yara-rules.md for writing custom detection rules.

Phase 3 — Similarity Analysis

Determine if the sample is related to known malware families.

# ssdeep fuzzy hash comparison against corpus
ssdeep -m known_hashes.txt <sample>

# TLSH locality-sensitive hash
tlsh -f <sample>
tlsh -c <sample> -l known_tlsh.txt

# imphash comparison (same imphash = same import structure = likely same family)
python3 -c "import pefile; pe=pefile.PE('<sample>'); print(pe.get_imphash())"

See references/similarity-analysis.md for fuzzy hashing methodology and thresholds.

Phase 4 — Dynamic Analysis (Sandboxed Execution)

Run the sample in an isolated environment when static analysis is insufficient.

Automated Sandbox Submission

# CAPEv2 submission
curl -F "file=@<sample>" http://<cape-host>:8000/apiv2/tasks/create/file/

# Check results
curl http://<cape-host>:8000/apiv2/tasks/view/<task_id>/

Behavioral Signals to Extract

Monitor sandbox output for:

Anti-Analysis Detection

If the sample detects the sandbox and refuses to execute, document the evasion technique:

• Timing checks: RDTSC, GetTickCount, Sleep acceleration
• Environment checks: VM artifacts, MAC prefixes, disk size, username
• Debugger checks: IsDebuggerPresent, int3 scanning, hardware breakpoints
• Human interaction checks: Mouse movement, click patterns, recent files

See references/behavioral-indicators.md for sandbox evasion catalog and countermeasures.

Phase 5 — IOC Extraction

Extract every actionable indicator from static and dynamic analysis.