Putting It Together: Static Triage Checklist

• Identify: file type / magic, 32 vs 64-bit, PE layout.
• Hash: MD5/SHA-256, imphash, ssdeep → lookup (hash first!).
• Packing? entropy, imports count, sections, DIE.
• Strings: ASCII + wide; FLOSS if empty. Note IOCs.
• Imports: map APIs to capabilities.
• capa: quick capability + ATT&CK overview.
• Ghidra: confirm behavior; XREF strings and APIs.
• Write YARA from what you found. Document IOCs.