<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-automated-malware-triage
description: >-
  Automate initial malware sample triage using sandbox detonation, YARA rule
  matching, hash lookups, and behavioral scoring. Covers integration with
  VirusTotal, CAPE Sandbox, and custom triage pipelines for rapid
  classification of unknown samples.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - malware-triage
  - yara
  - sandbox
  - virustotal
  - cape
  - automation
  - threat-intelligence
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1587.001"]
---

# Performing Automated Malware Triage

## Overview

Automated triage rapidly classifies unknown samples before committing analyst
time to deep-dive reverse engineering. A well-built pipeline hashes the sample,
checks reputation services, runs YARA rules for family identification, detonates
in a sandbox for behavioral analysis, and produces a confidence-scored verdict.
This skill covers building and operating such pipelines.

## Prerequisites

| Requirement | Install |
|---|---|
| YARA | `pip install yara-python` or `brew install yara` |
| vt-cli | `pip install vt-cli` or binary from VirusTotal |
| CAPE Sandbox | Docker deployment or hosted instance |
| ssdeep | `pip install ssdeep` — fuzzy hashing |
| pefile | `pip install pefile` — PE file parsing |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Triage Pipeline Stages

```
Sample Ingestion
    ↓
[Stage 1] File Identification
    → file type, magic bytes, size, entropy
    ↓
[Stage 2] Hash Reputation
    → MD5/SHA256 lookup against VT, MalwareBazaar
    ↓
[Stage 3] YARA Matching
    → Rule-based family/capability identification
    ↓
[Stage 4] Static Analysis
    → PE headers, imports, strings, packer detection
    ↓
[Stage 5] Sandbox Detonation
    → CAPE/Any.Run behavioral report
    ↓
[Stage 6] Verdict & Scoring
    → Classification, confidence, priority for analyst review
```

### File Identification

```python
import hashlib
import math
from collections import Counter
from pathlib import Path

def calculate_entropy(data: bytes) -> float:
    """Shannon entropy — high entropy suggests packing/encryption."""
    if not data:
        return 0.0
    counter = Counter(data)
    length = len(data)
    return -sum(
        (count / length) * math.log2(count / length)
        for count in counter.values()
    )

def identify_file(path: str) -> dict:
    data = Path(path).read_bytes()
    return {
        "size": len(data),
        "md5": hashlib.md5(data).hexdigest(),
        "sha256": hashlib.sha256(data).hexdigest(),
        "entropy": round(calculate_entropy(data), 4),
        "magic": data[:4].hex(),
        "packed_likely": calculate_entropy(data) > 7.2,
    }
```

### YARA Rule Matching

```bash
# Scan single file
yara -s rules/malware_families.yar sample.exe

# Scan with multiple rule sets
yara -r rules/ sample.exe

# Scan directory of samples
yara -r rules/malware_families.yar samples/
```

Example YARA rule for triage:

```yara
rule Emotet_Loader {
    meta:
        description = "Detects Emotet loader DLL"
        author = "defconxt"
        severity = "high"
        family = "emotet"
    strings:
        $s1 = "regsvr32" ascii
        $s2 = { 8B 45 ?? 83 C0 ?? 50 FF 15 }
        $pdb = "C:\\Users\\" ascii
        $api1 = "VirtualAllocExNuma" ascii
        $api2 = "GetNativeSystemInfo" ascii
    condition:
        uint16(0) == 0x5A4D and
        filesize < 500KB and
        ($s1 and $s2) or
        (2 of ($api*) and $pdb)
}
```

### VirusTotal Integration

```bash
# Lookup hash
vt file <sha256>

# Submit sample
vt scan file sample.exe

# Get behavioral report
vt file <sha256> --include=behaviours

# Search for related samples
vt search "type:peexe positives:10+ size:100KB-"
```

### CAPE Sandbox Submission

```bash
# Submit via API
curl -F "file=@sample.exe" http://cape.internal:8000/apiv2/tasks/create/file/

# Check task status
curl http://cape.internal:8000/apiv2/tasks/view/42/

# Get report
curl http://cape.internal:8000/apiv2/tasks/get/report/42/
```

### Scoring Model

| Factor | Weight | Scoring |
|---|---|---|
| VT detection ratio | 30% | 0-10 detections = low, 10-30 = medium, 30+ = high |
| YARA family match | 25% | Known family = high, capability rule = medium, no match = low |
| Entropy | 10% | >7.2 = packed (suspicious), 5-7 = normal, <5 = text-heavy |
| Behavioral indicators | 25% | Process injection, persistence, C2 = high |
| Packer detection | 10% | Known packer = medium, custom = high, none = low |

### Verdict Categories

| Verdict | Score | Action |
|---|---|---|
| **MALICIOUS** | 80-100 | Auto-block, create IOCs, notify SOC |
| **SUSPICIOUS** | 50-79 | Queue for analyst review within 4 hours |
| **LIKELY BENIGN** | 20-49 | Low-priority review, monitor for reclassification |
| **CLEAN** | 0-19 | Allow, add to known-good list |

## Workflow

1. **Ingest** — Receive sample from email gateway, EDR, or manual submission
2. **Identify** — Calculate hashes, file type, entropy
3. **Reputation** — Check VT, MalwareBazaar, internal threat intel
4. **YARA scan** — Match against family and capability rule sets
5. **Detonate** — Submit to sandbox, wait for behavioral report
6. **Score** — Aggregate factors into confidence-weighted verdict
7. **Route** — Auto-block malicious, queue suspicious for analyst
8. **Feedback** — Analyst verdicts improve scoring model over time

## Detection

```yaml
title: Automated Malware Triage Detection
id: b47a89f4-47dd-4729-b91a-76aee1bd4fbd
status: experimental
description: Detects suspicious activity related to performing automated malware triage techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*automated*"
  condition: selection
level: high
tags:
  - attack.t1587.001
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

| Check | Method |
|---|---|
| Pipeline processes samples | Submit known malware hash — verdict returned within 5 min |
| YARA rules load | `yara -v rules/` — no parse errors |
| VT integration works | `vt file <known-hash>` returns detection data |
| Sandbox responsive | `curl http://cape.internal:8000/apiv2/cuckoo/status/` — 200 OK |
| Scoring consistent | Same sample produces same verdict on repeated submission |

## References

- [YARA Documentation](https://yara.readthedocs.io/)
- [VirusTotal API v3](https://docs.virustotal.com/reference/overview)
- [CAPE Sandbox](https://capev2.readthedocs.io/)
- [MalwareBazaar](https://bazaar.abuse.ch/)
