Forensic triage and malware pre-analysis with Python
You automate file signatures, carving, PE and ELF headers, metadata and IOC extraction in Python to triage suspicious files safely.
Level 301 · 17 lessons · 15 practice labs
Lessons
Knowing the file
- Rules for handling a suspicious file safely
- Finding the real file type from magic bytes
- Finding similar files with ssdeep and TLSH
- Spotting packed or encrypted content with entropy
- Short task: find the files in a folder whose extensions lie
Executables
- PE headers and sections with pefile
- Imported functions and imphash
- Inspecting ELF files with lief
- Extracting Office macros and PDF objects
- Short task: report why a PE file is suspicious
Evidence and IOCs
- Carving files out of a disk image
- Collecting document and photo metadata
- Pulling IPs, domains, URLs and hashes out of text
- Defanging and sharing IOCs
- Short task: produce a shareable IOC list from an incident folder
Wrap-up
- Chain of custody and an analysis log with hashes
- Capstone: an automatic triage pipeline for suspicious files
Practice labs
- Files whose extensions lie: Write a script that reads the magic bytes of files in an incident folder and lists those whose extension does not match, with their real type.
- Where is the encrypted content: Write a script that computes entropy per file and per region, and show the packed or encrypted files in the folder told apart from ordinary compressed archives.
- Different builds of the same tool: Cluster the files in a sample pool by similarity with ssdeep and TLSH, find the rebuilt variants of the same training sample, and justify your threshold.
- A look at PE sections: Write a pefile script that tables the given PE file’s sections with size, permissions and entropy, and flags any section that is both writable and executable.
- Group samples by imphash: Compute and group the imphash values of the PE files in a sample folder, and separately list those importing process-memory-writing and remote-thread functions.
- Why is this PE suspicious: Examine the given PE file’s header timestamp, section names, imports, entropy and signature status, and turn the reasons for suspicion into a short scored report.
- Extract the macro from a document: Write a script that extracts the macro code from a training Office document sent to Tulip Pharmacy, and report the auto-run function and the address it downloads from.
- JavaScript hidden in a PDF: Write a script that walks the given PDF’s objects, finds those with JavaScript, auto actions or embedded files, and show the content by decoding the compressed stream.
- A triage pipeline for suspicious files: Build a pipeline that, for each file dropped into a folder, runs type detection, hashing, entropy, YARA matching and IOC extraction, keeps a chain-of-custody log and produces a summary report.
- Photo and document metadata: Write a script that collects author, software, creation time and location metadata from photos and documents in an incident folder and shows them in one table.
- A suspicious ELF file: Inspect the libraries, symbols and sections of an ELF file found on a server with lief, and explain in a short note how it differs from an ordinary system tool.
- A deleted file from a disk image: Search the given small disk image for file signatures, carve out deleted images and documents, hash them and record each with its offset in the evidence log.
- Pull IOCs from a report: Write a script that extracts IPs, domains, URLs and hashes from the given incident notes with regexes, removes duplicates and groups them by type.
- A shareable IOC list: Turn the indicators in an incident folder into a shareable, defanged list with internal addresses removed, and show the refang function gives back the same values.
- The IOC extractor mistakes file names for domains: Fix an extractor that takes file names such as report.pdf and settings.json for domains and version numbers for IPs, and show by measurement on labelled text that precision improved.
About this course
You automate file signatures, carving, PE and ELF headers, metadata and IOC extraction in Python to triage suspicious files safely.
What you will learn
- Knowing the file
- Executables
- Evidence and IOCs
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.