Static analysis can reveal a decoder, an imported API or an embedded string. It cannot establish that every reachable-looking branch ran on a host. Keep those levels of evidence distinct.
Use Reverse mode for supported, bounded static binary inspection when the configured runner is available. The uploaded binary is not executed. For a larger investigation, bring selected decompiler output and observations from your own analysis environment into the conversation.
Start with this material
- A selected supported binary or a bounded excerpt of disassembly or decompiled source.
- A file hash, format and the question you are trying to answer, such as configuration decoding.
- Known observations kept separate from labels, antivirus names and unverified third-party claims.
Work through the evidence
- Establish the format, sections and relevant imports. Record which observations come from the file and which come from a tool’s interpretation.
- Follow a small function and its callers. Track byte transformations, lengths and error paths before assigning meaning to decoded data.
- Ask for candidate indicators with source offsets or function references and a confidence explanation. Do not promote a string to a contacted endpoint without evidence.
- Cross-check the result in your own disassembler. Any dynamic investigation belongs in a separately controlled environment; this static workflow does not execute the sample.
A prompt to adapt
Adapt to your evidence
Explain this configuration-decoding function and its callers. Track each byte transformation and identify the output’s consumers. Distinguish a decoded string from a confirmed network destination. List the offsets or functions supporting each conclusion and the evidence still needed to establish runtime behavior.
Check the result
- Hashes and source references allow another analyst to inspect the same bytes.
- The explanation accounts for control flow, buffer lengths and failed decoding paths.
- Indicators are labeled by evidence type; no claim of execution, persistence or network contact comes from a string alone.
Bring your own evidence into a conversation and work through the next question.
Open chat