P09 Lab 04 — Malware Static-Triage / YARA-style Matcher

WARMUP: Chapter 11 (safe malware triage). Safety: Phase 00 — never execute samples.

The idea

Static triage answers "what is this and what does it likely do?" without running the sample. It reasons over static features: file entropy (near the 8.0 byte-max ⇒ packed/encrypted), imported APIs (dangerous combinations betray behavior — the VirtualAllocEx+WriteProcessMemory+ CreateRemoteThread injection trio, persistence, network, anti-debug, crypto), strings, and signature status — plus YARA-style rule matching. The output is a fast verdict and containment-relevant behaviors that feed detections (Labs 01/03), not a full reverse-engineering teardown.

What you build (lab.py)

  • file_entropy_verdict(entropy) — packed/encrypted vs normal.
  • suspicious_imports(imports) — behavior tags (process-injection requires the full trio; persistence/network/anti-debug/crypto).
  • match_rule / match_rules — YARA-style (all imports ∧ any string ∧ entropy floor).
  • triage(sample, rules) — {matched_rules, behaviors, packed, verdict, severity}: malicious if a rule matches or injection is present; suspicious if packed or any behavior; else benign.

Cases the tests cover

  • Entropy verdict; injection requires all three APIs; multi-behavior tagging; a benign signed sample; a packed sample (suspicious); an injection sample (malicious/high); a YARA ransomware-rule match (malicious); rule requiring all imports and a string; the rule entropy gate.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

  • Parse a real PE/ELF (sections, imports, entropy per section) instead of a feature model.
  • Compute imphash/ssdeep fuzzy hashes and cluster samples into families.
  • Generate a YARA rule from a confirmed sample and feed IOCs/behaviors into the detection labs.

Interview / resume

"Built a static malware-triage engine — entropy-based packing detection, import-combination behavior inference (process injection, persistence, network, crypto), and YARA-style rule matching — producing a verdict and containment behaviors without ever executing the sample."

Limitations: reasons over a static-feature model (no real PE/ELF parsing, no imphash/fuzzy hashing, no dynamic analysis); behavior inference is heuristic.