Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Browser LabLD-MAL-LAB-001Medium
Browser LabLD-MAL-LAB-001Medium28 min

Static Triage of a Suspicious Attachment

Badr Engineering's mail filter quarantined an attachment named quote.pdf. You have its static analysis output only — magic bytes, hashes, strings, imports and the PE section table. Without ever running it, decide what it really is and what it is capable of. Claim only what static evidence supports.

What you will be able to do

  • Identify the true file type from magic bytes, not extension.
  • Infer capability from imports.
  • Recognize packing from entropy and section flags.
Windows SecurityIOC AnalysisT1027Obfuscated/Packed FilesT1055Process Injection

Sign in to start this lab.

Sign in