Lion Cipher Lab
Triage an unknown binary without running it: capabilities with capa, hidden strings with FLOSS
- Threat Intel Analyst
- Advanced
- ~75 min
- Free · no account required
Why it matters
A threat-intel or incident-response analyst does not get to run every suspicious file they receive -- there are too many of them, running them is dangerous, and a live sample can detect that it is being watched and behave. So the first move on almost any unknown binary is TRIAGE: a fast, safe, static look that reads the file on disk -- without executing a single instruction -- to answer one question, 'is this worth more of my time, and what kind of time?' Triage is what lets one analyst survive a queue of thousands of samples: most files can be dispositioned in minutes from static evidence…
What you'll learn
- the difference between STATIC analysis (reading a file without running it) and DYNAMIC analysis (detonating it in a sandbox), and why triage is static-first
- cross-compiling a benign Windows PE (portable executable) on Linux with mingw-w64, so the whole exercise is safe and perfectly reproducible
- running capa to extract a binary's CAPABILITIES and reading its ATT&CK / MBC mapping without executing the sample
- reading capa -vv to see WHICH rule matched at WHICH address, and following the match back to the human-readable .yml rule that IS the analysis
- recovering obfuscated / stackstring strings with FLOSS that a naive `strings` run silently misses, and contrasting the two outputs directly
- writing a static triage verdict: what the sample likely DOES, and whether it earns deeper dynamic or reverse-engineering effort
- the honest limits: capa's rule-based false negatives, its near-total failure on packed/obfuscated code, FLOSS's slow non-exhaustive emulation, and that static analysis cannot prove runtime behavior
- the pro triage chain (capa + FLOSS + PE metadata -> sandbox -> Ghidra/IDA on the flagged few) and the isolated-VM-no-network discipline you would use on a REAL sample
Steps in this lab
- What triage is, and why the first look is always static
- Install the cross-compiler so you can build a Windows PE on Linux
- Write the benign suspect: a program with recognizable capabilities and a hidden string
- Cross-compile the suspect into a Windows .exe (and never run it)
- Install capa and FLOSS
- Run capa: read the capability table and its ATT&CK mapping
- Run capa -vv: which rule matched, at which address, and the rule IS the analysis
- strings vs FLOSS: watch the hidden marker appear
- Write the triage verdict from static evidence alone
- The limits, said plainly: packing, false negatives, and what static cannot prove
- The judgment: when static triage is the right move, and how the pros chain it