Explain how you would perform a basic malware triage on a suspicious executable found on a user’s machine, using only the tools typically available to a mid-level analyst (e.g., sandboxing platform, EDR, hash lookups, static analysis utilities). What specific indicators would you extract and how would you use them?

Question

VirtualInterview.AI · Accepted Answer

With a suspicious EXE, my first step is to preserve and hash it (MD5/SHA256) and immediately submit the hash to VirusTotal and our internal intel. In one incident, just that step showed 30+ detections and saved us hours. Next, I’d do quick static triage: file type validation, digital signature check, strings, imports, and any embedded URLs or IPs. I’ll pull mutex names, registry keys, and scheduled task names if visible. In parallel, I’ll use our sandbox to observe behavior: network calls, dropped files, process injection, and persistence changes. EDR helps correlate this with what actually happened on the host: execution chain, command-line args, and modifications in the last 24 hours. From all this, I extract IOCs (hashes, domains, IPs, registry paths, filenames, mutexes) and TTPs. Then I feed those into our SIEM and EDR to hunt for additional infections, and I share a short report with IR and IT so they can contain, remediate, and improve detections.

Sample Answer

Keywords