01 / Input
Understand your environment
Sample provenance, hash verification, chain-of-custody and handling plan.
Services / Security
Malware Analysis, Threat Research & Defensive Reverse Engineering
A suspicious executable or mobile package should not be dismissed or blindly run. We can scope forensic triage, static inspection and controlled behavioral analysis of viruses, worms, Trojans, spyware, rootkits and ransomware, then document what is supported by the evidence.
Assessment method
An endpoint alert identified a suspicious binary but did not explain its capabilities or impact.
Defensive investigation for organizations that need to determine what a suspected malicious artifact does, how it may have entered an environment and what security controls should change. Work begins with authorization, sample provenance, safe-transfer arrangements and confirmation of an appropriate isolated analysis environment. Suspicious files must not be sent through public contact forms.
01
Boundary to inspect
An endpoint alert identified a suspicious binary but did not explain its capabilities or impact.
02
Test execution
Sample provenance, hash verification, chain-of-custody and handling plan.
03
Evidence to capture
Executive impact brief separating confirmed findings, hypotheses and unknowns.
Test plan
Testing and deliverables
Security testing coverage
- Sample provenance, hash verification, chain-of-custody and handling plan.
- Static analysis of metadata, imports, strings, configuration and suspicious control flow.
- Controlled dynamic behavior analysis in a validated, isolated environment when available and authorized.
- Persistence, process, filesystem, registry/service and network-behavior analysis as platform-appropriate.
- Virus, worm, Trojan, ransomware, spyware and rootkit behavior classification based on observed evidence.
- Mapped indicators, likely initial-access hypotheses and ATT&CK technique references with confidence labels.
- Detection engineering handoff and remediation validation with the customer's defenders.
Findings and remediation
- Executive impact brief separating confirmed findings, hypotheses and unknowns.
- Technical behavior report with sample hashes, evidence references and analysis limitations.
- Reviewed file, network and host indicators suitable for customer detection pipelines.
- Prioritized containment, eradication, monitoring and revalidation recommendations.
- Optional YARA/Sigma or SIEM detection logic with test cases when scoped.
Technologies and methods
- Ghidra
- Disassembly
- Sandbox isolation
- YARA
- Sigma
- MITRE ATT&CK
- Volatility (when appropriate)
Synthetic examples
Engineering in practice
Sample security findings and reports
Fictional examples showing how we organize security findings and fixes.
Explore ProjectsHOW THE WORK IS DELIVERED
Expertise you can put to work.
Explore how our engineering and security work moves from discovery to implementation, testing and delivery.
02 / Verification
Investigate and implement
Static analysis of metadata, imports, strings, configuration and suspicious control flow.
03 / Output
Deliver practical results
Executive impact brief separating confirmed findings, hypotheses and unknowns.
Example deliverable structure
Clear findings. Practical next steps.
01Affected component & scope
02Observed behavior and reproduction
03Impact, preconditions and limits
04Correction, owner and retest
Frequently Asked Questions
Answers to your questions
Can you analyze a Trojan, worm, virus or ransomware sample?
We can evaluate scope and analysis feasibility for those artifact classes. Sample collection, specialist tooling, staffing and isolation are confirmed for the specific engagement; no unattended public sample upload is offered.
Can we send a malicious file with the initial inquiry?
No. Send only a non-sensitive description, detection context and contact details. Raw samples, credentials and controlled data require a separate approved secure evidence-transfer process.
Can you work with a foreign defense organization?
Potentially, after customer, jurisdiction, end-user and data-classification review. U.S. export controls, sanctions and any required authorizations must be resolved before providing controlled defense services or technical data.
Our Approach
How we work with your team
Discovery
We review your goals, existing environment and the systems or workflows involved.
Engagement planning
Testing requires written authorization, named targets, allowed techniques and stop conditions. We define the delivery plan and responsibilities together.
Results and handoff
Your team receives the agreed implementation or findings, testing results and a clear next-step plan.
Learn more about our process: Our Approach.
Next step
Need a defensible answer about suspicious software?
Start with the affected platform, detection context, business impact and whether the artifacts are controlled. Do not attach executable samples or confidential incident evidence to your initial message.