Malware Analysis
What our pipeline knows about a sample: its file type, packing, matched patterns and related samples.
SHA-256 only. It is the key our analysis database is indexed on: we never receive the file itself, only its fingerprint.
How to read it
Entropy is not a verdict
It measures how random the bytes are, from 0 to 8. Close to 8 means compressed or encrypted, which is what packers do, and also what most legitimate installers do.
Indicators are strings
The addresses and URLs are what a byte scan found inside the file. Many belong to certificates and libraries the file merely carries, not to anything it contacts.
A match is a family, not a name
A DYNEX rule matches a code pattern. Thirty thousand samples sharing one generic loader means the loader is common, not that they all belong to the same campaign.