Lab 01 — Binary Triage Engine
Operation Cedar Lattice, Phase 11.
A captured binary arrived from the Meridian Freight International environment. FIN-LATTICE is suspected. Before you invest hours in a full decompilation session, you run triage: compute section entropy, identify packing, classify suspicious strings, and produce a structured report that the rest of the team can act on. This lab implements that triage pipeline.
Safety. This lab is an analyzer over synthetic binary metadata dictionaries. There is no executable code, no shellcode, no working exploit, and no actual binary parsing. The input is a Python dict; the output is a structured FINDINGS report.
What You Will Build
Four functions that implement the Cedar Lattice Binary Triage Pipeline:
| Function | Input | Output |
|---|---|---|
high_entropy_sections(metadata) | binary metadata dict | list[str] — section names |
packer_detected(metadata) | binary metadata dict | str | bool — packer name or False |
suspicious_strings(strings_list) | list[str] | list[dict] — classified strings |
triage_report(metadata) | binary metadata dict | full report dict |
Metadata Schema
{
"file_type": "PE32+" | "ELF64" | str,
"architecture": "x86_64" | "i386" | str,
"sections": [
{"name": str, "entropy": float, "size": int}
],
"imports": [
{"dll": str, "function": str}
],
"exports": [str],
"strings": [str],
"pdb_path": str | None,
"timestamp": int,
"imphash": str | None,
"opsec_flags": [str], # optional
}
Function Specifications
high_entropy_sections(metadata)
Return a list of section name strings where entropy > 7.0.
High entropy (close to 8.0 bits/byte) indicates compressed, encrypted, or packed content.
packer_detected(metadata)
Return a packer identification string or a boolean:
| Condition | Return Value |
|---|---|
| Any section entropy > 7.0 and import count <= 3 | "likely_packed" |
Section named .UPX0 or .UPX1 | "UPX" |
Section named themida or .themida | "Themida" |
| None of the above | False |
Checks run in the order listed above. Return on first match.
suspicious_strings(strings_list)
Classify each string in strings_list. Return only strings that match at least one
category. Each result is a dict {string, category, severity}.
Categories (check in this order, first match wins):
| Category | Detection Rule | Severity |
|---|---|---|
"url" | starts with "http://" or "https://" | HIGH |
"ip_address" | matches IPv4 pattern: digits.digits.digits.digits | HIGH |
"shell_command" | contains "cmd.exe" or "powershell" (case-insensitive) | HIGH |
"base64_like" | length >= 20 and all chars in base64 alphabet (A-Za-z0-9+/=) | MEDIUM |
"high_entropy_str" | length >= 16, no spaces, not all hex chars | LOW |
Sort output by severity descending (HIGH then MEDIUM then LOW), then by string alphabetically within each severity group.
triage_report(metadata)
Produce a structured report dict:
{
"file_type": str,
"architecture": str,
"packer": str | bool,
"high_entropy_sections": list[str],
"suspicious_strings": list[dict],
"imphash": str | None,
"pdb_path": str | None,
"classification": str,
"opsec_flags": list[str],
}
Classification logic (first match wins):
| Classification | Condition |
|---|---|
"injector" | imports include NtAllocateVirtualMemory AND (NtWriteVirtualMemory OR WriteProcessMemory) |
"loader" | exports include "ReflectiveLoader" OR packer_detected() is truthy |
"credential_stealer" | strings contain "lsass", "SAM", or "NTLM" (case-insensitive) |
"dropper" | strings contain "http://" or "https://" AND packer_detected() is truthy |
"unknown" | none of the above |
opsec_flags comes from metadata.get("opsec_flags", []).
Files
| File | Purpose |
|---|---|
lab.py | Your implementation — stubs with NotImplementedError |
solution.py | Complete reference solution |
test_lab.py | 13 adversarial pytest tests |
requirements.txt | pytest>=7.0 |
Running the Tests
# Run against your stubs (expect NotImplementedError)
pytest -q
# Run against reference solution (all 13 should pass)
LAB_MODULE=solution pytest -q
Learning Objectives
After completing this lab you should be able to:
- Explain Shannon entropy and why values above 7.0 bits/byte indicate packing or encryption.
- Identify UPX and Themida packer signatures from section names and import table heuristics.
- Classify suspicious strings by behavioral category and assign severity.
- Map import table contents to likely malware classification (loader, injector, credential stealer, dropper).
- Produce a structured triage report that drives downstream analysis decisions.