2.3.3. File Analysis and Sandboxing

💡 First Principle: Static file analysis identifies what a file looks like; dynamic analysis (sandboxing) reveals what it does — and malware designed to evade static detection may still reveal itself through its behavior during execution.

Static file analysis examines a file without executing it:

• Hashing (MD5, SHA-256) creates a unique fingerprint. Comparing against known-malware databases (VirusTotal, NSRL) quickly identifies known threats. New/unknown hashes don't mean safe — just not previously seen.
• String extraction (strings command) finds human-readable text embedded in binaries: URLs, IP addresses, error messages, function names. A binary containing http://185.220.101.x/download and CreateRemoteThread is suspicious even before execution.
• VirusTotal submits file hashes or files to 70+ antivirus engines simultaneously. Note: submitting actual files shares them with VirusTotal's database — appropriate for unknown malware but check policies before submitting proprietary files.
• Entropy measures randomness from 0 to 8 bits per byte. Values near 8 (above roughly 7) mean the content is packed, compressed, or encrypted, which is how malware hides its code. High entropy plus a clean, silent sandbox run suggests a sample that detected the sandbox and withheld its payload, not a benign file.
• Hash commands: sha256sum file (or md5sum) on Linux; Get-FileHash or certutil -hashfile on Windows.
• Office macros: olevba (from oletools) extracts VBA macro code without opening the document. An Auto_Open/AutoOpen/Document_Open entry point, Shell() or WScript.Shell calls, and string obfuscation (StrReverse, Chr() concatenation) describe an obfuscated, self-executing macro that launches OS commands, so move on to an isolated sandbox. Safe order for an unknown document: hash lookup, static strings and macro review, then sandbox; never open it on a working machine.

Dynamic analysis (sandboxing) executes the suspicious file in an isolated environment and observes its behavior: what files it creates, what processes it spawns, what network connections it makes, what registry changes it makes.

Sandboxing limitations: sophisticated malware detects sandbox environments (VM detection, delayed execution, checking for user activity) and doesn't execute its payload when sandboxed. This is a known limitation — a "clean" sandbox run doesn't definitively prove the file is safe.

DNS and IP Reputation Tools:

• WHOIS — Reveals domain registration information (registrar, registration date, registrant). A domain registered yesterday with privacy-protected WHOIS that's receiving C2 traffic is highly suspicious.
• AbuseIPDB — Community database of IP addresses reported for malicious activity (spam, scanning, C2). Check destination IPs when investigating suspicious outbound connections.

⚠️ Exam Trap: A file that returns "not detected" from VirusTotal is not confirmed safe — it may be a new variant, a targeted attack tool not in the database, or a file that's been slightly modified to change its hash. Hash evasion (changing one byte) defeats hash-based detection while leaving functionality intact.

Reflection Question: A sandbox analysis of a suspicious email attachment shows no network connections, no file writes, and no process spawns. A junior analyst marks it as benign. What technique might explain these results, and what additional analysis steps would you take?