The Academy is free // the war room is optional
DAEMONCORE // ACADEMY
← FIELD NOTES

Static triage of suspicious binaries without execution

2026.09.05//8 MIN READmalware-analysisincident-responsedigital-forensicssecurity-labs

// Introduction

When you encounter a suspicious binary, executing it isn't an option. Instead, a meticulous static analysis can yield insights into its behavior and intent without risk. This post outlines a methodology for triaging binaries using static analysis techniques, focusing on tools and commands that facilitate this process.

// Environment Setup

Use a clean environment to avoid contamination of your analysis workflow. Setting up a dedicated lab environment with tools like Ghidra, Binwalk, and strings is advisable. For this analysis, ensure you have the following packages installed:

sudo apt-get install binutils gdb ghidra binwalk

// Methodology

File Identification

The first step is to identify the file type. Use the file command to gather initial data.

file suspicious_binary.exe

This command provides information about the file format, architecture, and potential operating system compatibility. A common output might look like:

suspicious_binary.exe: PE32 executable (console) Intel 80386, for MS Windows

The output indicates a Windows PE file, a common format for malware.

Strings Analysis

Next, extract readable strings from the binary to find hints about its functionality. Use strings:

strings suspicious_binary.exe | less

Look for URLs, suspicious function names, or any indicators of intent. Pay attention to:

  • Hardcoded IP addresses
  • User-agent strings
  • Any mention of antivirus bypass techniques

Disassembly

For deeper insights, disassemble the binary using Ghidra or Radare2. This process may reveal control flow and function calls that are indicative of malicious operations. With Ghidra, you can: 1. Import the binary. 2. Analyze it using its automatic analysis features. 3. Explore the disassembled code in the CodeBrowser.

When working with Ghidra, ensure you configure the project correctly, especially the architecture and data type settings. This can affect the analysis accuracy.

Behavior Analysis with Binwalk

If the binary is a packed executable or contains embedded files, Binwalk can help identify these layers:

binwalk suspicious_binary.exe

This command scans for embedded files and executables. If Binwalk detects any compressed sections, extract them for further examination:

binwalk -e suspicious_binary.exe

Checking For Known Indicators

Utilize YARA rules to check for known malware signatures. If you have a collection of YARA rules, you can run:

yara -r /path/to/yara_rules/ suspicious_binary.exe

This command recursively checks the binary against your rule set. Reviewing the matches can provide context about the binary's behavior.

Documentation and Reporting

As you conduct your analysis, document each step meticulously. Record file hashes using sha256sum to keep track of the original file. Example:

sha256sum suspicious_binary.exe

Hashing ensures the binary's integrity during analysis, preventing mix-ups with different versions.

// Common Mistakes to Avoid

  • Ignoring File Types: Always check the file type before analysis; different file types require different strategies.
  • Neglecting Documentation: Without proper documentation, you may lose critical insights from your analysis.
  • Relying Solely on Automated Tools: Tools can aid analysis but always apply your judgment.

// Defensive Implications

Understanding how to triage binaries can enhance your organization's incident response capabilities. By implementing static analysis techniques, you can:

  • Improve detection of previously unseen malware.
  • Develop effective response strategies based on binary characteristics.

// Checklist for Static Triage

  • [ ] Identify the file type using file.
  • [ ] Extract strings with strings.
  • [ ] Disassemble the binary with Ghidra or Radare2.
  • [ ] Analyze embedded files using Binwalk.
  • [ ] Check with YARA rules.
  • [ ] Document findings and hash the original file.

// Conclusion

Static triage of suspicious binaries is a critical skill for any security practitioner. By applying the outlined methodology, the potential risks of executing unknown binaries can be mitigated, allowing for safe and effective analysis. Remember, the techniques discussed belong in a disposable range you control. The DaemonCore Academy provides resources to hone these skills for free.