Lion Cipher Lab
Investigate a suspicious file — safely
- Digital Forensics & IR (DFIR)
- Intermediate
- ~35 min
- Free · no account required
Why it matters
"Someone sent me this file — is it safe to open?" is one of the most common questions a defender is handed, and answering it without getting infected is a genuine day-one DFIR skill. The professional answer is triage: you learn everything you can about a file WITHOUT running it. Attackers rename malicious files to look harmless (a program dressed up as invoice.pdf), hide command-and-control URLs and IP addresses inside them, and leave revealing metadata behind. Static triage — checking the true file type, reading the strings, pulling the metadata, and looking the file's hash up against threat…
What you'll learn
- file triage
- identifying real file type with file
- extracting strings
- reading metadata with exiftool
- hashing for identification
- hash lookups on threat intelligence
- safe handling in a VM
Steps in this lab
- First rule: analyse, don't execute — and do it in a snapshot
- What is this file, really? Ask `file`, not the extension
- Read what's hidden inside with `strings`
- Pull the metadata with `exiftool`
- Fingerprint the file with a hash
- Check the hash against threat intelligence — search, don't upload
- Why this order is the whole skill