First look at an unknown file, safely
Someone sends you a file and asks "what is this?". The first ten minutes are about learning as much as possible without running it. This post is a checklist for that static triage.
Rule zero: where you work
- Work in a virtual machine with no shared folders and no clipboard sharing, and take a snapshot first so you can roll back.
- Turn off networking, or use a host-only network, unless you deliberately want to see what the file talks to.
- Never double-click. Don't open documents in a normal office suite either: macros and exploits are the point of many malicious files.
- Keep samples zipped with a password (
infectedis the common convention) when moving them around, so nothing opens them by accident.
None of the steps below execute the file. They only read it.
1. Fingerprint it
sha256sum sample.binThe hash identifies the file exactly. Write it in your notes. Searching for the hash (not uploading the file) on public threat-intelligence sites often tells you instantly whether it's known. Uploading a file can reveal to its author that someone is looking, so think before you do that.
2. What type is it really?
file sample.binfile ignores the extension and looks at the content, mostly the first bytes. Common signatures are worth knowing by sight:
7f 45 4c 46(.ELF): Linux executable or library4d 5a(MZ): Windows executable (PE)50 4b 03 04(PK): ZIP, which includes.docx,.xlsx,.jarand.apk25 50 44 46(%PDF): PDF23 21(#!): a script with an interpreter line
A file called invoice.pdf that starts with MZ has told you most of what you need.
3. Strings
strings -n 6 sample.bin | less
strings -n 6 -e l sample.bin | less # UTF-16LE, common in Windows programsLook for URLs, IP addresses, file paths, registry keys, error messages, user agents, and names of libraries or functions. Strings are cheap clues, but treat them as hints: they can be planted to mislead, and important ones are often encrypted.
The Strings tab on this site does the same thing for each page: press s.
4. Structure
For ELF files:
readelf -h sample.bin # header: 32/64-bit, CPU, entry point
readelf -l sample.bin # segments and their permissions
readelf -d sample.bin # needed libraries
readelf -Ws --dyn-syms sample.bin # imported and exported symbolsFor PE files, tools like pefile (Python), PE-bear or Detect It Easy show the same things: sections, imports, timestamps and resources.
Imports are especially telling. A program that imports networking, process-creation and registry functions can do those things; one that imports almost nothing may be packed and resolve its functions at run time.
5. Entropy: is it packed?
Compressed or encrypted data looks random. A section with entropy close to 8 bits per byte, a tiny import table and few readable strings usually means the real code is packed and unpacked in memory. binwalk -E sample.bin plots entropy across the file, and Detect It Easy reports it per section and often names the packer.
6. Write it down
Before moving on to disassembly or a sandbox, write a short summary: hash, real type, architecture, notable strings, imports, packed or not, and your best guess about what it is. It forces you to separate what you know from what you suspect, and it's the note you'll want in six months.
Next steps
Only after this do you open it in a disassembler (IDA, Ghidra, Binary Ninja, radare2) or run it in an isolated sandbox to watch its behaviour. Static triage tells you where to look, so those steps go much faster.