handling-malware-samples-safely

Name: handling-malware-samples-safely
Author: meltedinhex

18stars5forks

How to install handling-malware-samples-safely?

meltedinhex/analyst-ai-pack/handling-malware-samples-safely

$npx -y skills add meltedinhex/analyst-ai-pack --skill handling-malware-samples-safely

Installs into the current project.

Summary

Establishes safe practices for acquiring, storing, transferring, and disposing

Files · 1

View on GitHub

SKILL.md

1	# Handling Malware Samples Safely
2
3	## When to Use
4
5	- You are receiving, storing, or sharing a malicious file and need to prevent accidental
6	execution or contamination.
7	- You need a consistent naming and identity scheme so a sample can be tracked across tools
8	and tickets.
9	- You are packaging a sample to send to another analyst or a sandbox.
10
11	Do not use these conventions as a substitute for an isolated detonation environment; safe
12	storage prevents accidents but analysis still requires an isolated lab.
13
14	## Prerequisites
15
16	- An archive tool that supports password-protected, encrypted archives (7-Zip).
17	- A hashing utility (`sha256sum`, `certutil`, or the bundled script).
18	- A defined storage location with restricted access, separate from general file shares.
19
20	## Safety & Handling
21
22	- Treat every sample as live. Never double-click; never leave it with its original
23	executable extension on a working machine.
24	- Store samples inside an encrypted, password-protected archive with the conventional
25	password `infected`.
26	- Neutralize the extension on disk (e.g. `sample.exe` → `sample.exe.bin` or
27	`sample.exe_`) so the OS will not execute it on a stray click.
28	- Defang indicators in any text leaving the lab: `hxxp://`, `1.2.3[.]4`, `evil[.]com`.
29
30	## Workflow
31
32	### Step 1: Identify the sample by hash
33
34	A sample's identity is its SHA-256, not its filename. Compute hashes immediately:
35
36	```bash
37	python scripts/analyst.py hash sample.exe
38	# md5, sha1, sha256, size, ssdeep-like size bucket
39	```
40
41	Rename the working copy to its SHA-256 so identity travels with the file:
42
43	```bash
44	mv sample.exe 9f86d0818...<sha256>.bin
45	```
46
47	### Step 2: Store in an encrypted archive
48
49	```bash
50	7z a -p"infected" -mhe=on <sha256>.7z <sha256>.bin
51	# -mhe=on encrypts filenames too
52	```
53
54	Keep the loose, neutralized copy only inside the lab; the archive is the storage/transfer
55	form.
56
57	### Step 3: Record provenance
58
59	Capture where the sample came from, when, and who handled it. The script can emit a JSON
60	metadata record:
61
62	```bash
63	python scripts/analyst.py record <sha256>.bin --source "MalwareBazaar" --case CASE-001
64	```
65
66	### Step 4: Defang before sharing
67
68	When pasting URLs/IPs into a report or ticket, defang them:
69
70	```bash
71	python scripts/analyst.py defang ioc.txt
72	# http://evil.com/x -> hxxp://evil[.]com/x
73	```
74
75	## Validation
76
77	- `7z l -slt <sha256>.7z` shows encrypted headers (filenames not visible without password).
78	- The on-disk working copy has a neutralized extension and matches the recorded SHA-256.
79	- The provenance record contains source, timestamp, case ID, and all three hashes.
80	- No raw clickable URLs/IPs remain in any artifact destined to leave the lab.
81
82	## Pitfalls
83
84	- Sharing a sample in a plain zip — mail gateways and AV will quarantine or mangle it, and
85	recipients risk accidental execution. Always password-encrypt.
86	- Trusting the filename or first-seen label as identity; only the hash is authoritative.
87	- Forgetting filename encryption (`-mhe=on`), which leaks the sample name and your naming
88	scheme.
89	- Defanging only URLs but leaving live IPs or email addresses in the report.
90
91	## References
92
93	- See [`references/api-reference.md`](references/api-reference.md) for the hashing,
94	provenance, and defang tooling.
95	- MalwareBazaar and NIST SP 800-86 (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

handling-malware-samples-safely

18stars5forks

View on GitHub

How to install handling-malware-samples-safely?

meltedinhex/analyst-ai-pack/handling-malware-samples-safely

$npx -y skills add meltedinhex/analyst-ai-pack --skill handling-malware-samples-safely

Installs into the current project.

Summary

Establishes safe practices for acquiring, storing, transferring, and disposing

Files · 1

View on GitHub

SKILL.md

1	# Handling Malware Samples Safely
2
3	## When to Use
4
5	- You are receiving, storing, or sharing a malicious file and need to prevent accidental
6	execution or contamination.
7	- You need a consistent naming and identity scheme so a sample can be tracked across tools
8	and tickets.
9	- You are packaging a sample to send to another analyst or a sandbox.
10
11	Do not use these conventions as a substitute for an isolated detonation environment; safe
12	storage prevents accidents but analysis still requires an isolated lab.
13
14	## Prerequisites
15
16	- An archive tool that supports password-protected, encrypted archives (7-Zip).
17	- A hashing utility (`sha256sum`, `certutil`, or the bundled script).
18	- A defined storage location with restricted access, separate from general file shares.
19
20	## Safety & Handling
21
22	- Treat every sample as live. Never double-click; never leave it with its original
23	executable extension on a working machine.
24	- Store samples inside an encrypted, password-protected archive with the conventional
25	password `infected`.
26	- Neutralize the extension on disk (e.g. `sample.exe` → `sample.exe.bin` or
27	`sample.exe_`) so the OS will not execute it on a stray click.
28	- Defang indicators in any text leaving the lab: `hxxp://`, `1.2.3[.]4`, `evil[.]com`.
29
30	## Workflow
31
32	### Step 1: Identify the sample by hash
33
34	A sample's identity is its SHA-256, not its filename. Compute hashes immediately:
35
36	```bash
37	python scripts/analyst.py hash sample.exe
38	# md5, sha1, sha256, size, ssdeep-like size bucket
39	```
40
41	Rename the working copy to its SHA-256 so identity travels with the file:
42
43	```bash
44	mv sample.exe 9f86d0818...<sha256>.bin
45	```
46
47	### Step 2: Store in an encrypted archive
48
49	```bash
50	7z a -p"infected" -mhe=on <sha256>.7z <sha256>.bin
51	# -mhe=on encrypts filenames too
52	```
53
54	Keep the loose, neutralized copy only inside the lab; the archive is the storage/transfer
55	form.
56
57	### Step 3: Record provenance
58
59	Capture where the sample came from, when, and who handled it. The script can emit a JSON
60	metadata record:
61
62	```bash
63	python scripts/analyst.py record <sha256>.bin --source "MalwareBazaar" --case CASE-001
64	```
65
66	### Step 4: Defang before sharing
67
68	When pasting URLs/IPs into a report or ticket, defang them:
69
70	```bash
71	python scripts/analyst.py defang ioc.txt
72	# http://evil.com/x -> hxxp://evil[.]com/x
73	```
74
75	## Validation
76
77	- `7z l -slt <sha256>.7z` shows encrypted headers (filenames not visible without password).
78	- The on-disk working copy has a neutralized extension and matches the recorded SHA-256.
79	- The provenance record contains source, timestamp, case ID, and all three hashes.
80	- No raw clickable URLs/IPs remain in any artifact destined to leave the lab.
81
82	## Pitfalls
83
84	- Sharing a sample in a plain zip — mail gateways and AV will quarantine or mangle it, and
85	recipients risk accidental execution. Always password-encrypt.
86	- Trusting the filename or first-seen label as identity; only the hash is authoritative.
87	- Forgetting filename encryption (`-mhe=on`), which leaks the sample name and your naming
88	scheme.
89	- Defanging only URLs but leaving live IPs or email addresses in the report.
90
91	## References
92
93	- See [`references/api-reference.md`](references/api-reference.md) for the hashing,
94	provenance, and defang tooling.
95	- MalwareBazaar and NIST SP 800-86 (linked in frontmatter).

People who liked this also viewed

6 picks

Type