Sample Triage Checklist

A little checklist for the steps one should take when triaging a sample

When receiving a sample, multiple steps are to be taken before heading further into the static analysis ( reverse engineering ) or dynamic analysis ( debugging )

• Hash and upload to VT (MD5, SHA1, SHA256)

• Strings + FLOSS

• Validate if the sample is packed

  • Entropy >= 6?

  • Virtual Size much bigger than Size of Raw Data?

  • Very limited amount of imports?

• Check when the sample was compiled ( can be faked )