AVL Code
All cases
#002 · Sample Analysis

Case study · Sample Analysis

In-Depth Analysis of the fast16 Malware

You are the analyst assigned a sample-analysis task: you only get a hash, the sample cannot be executed, the report must be HTML, and ideally you deliver a detection tool too. Work through the three steps in this article and you will end up with a 22,313-byte HTML analysis report, a zero-dependency detection tool, and 5 YARA rules — with the sample never executed.

PE32 · 308KB (315,392 bytes) · overall entropy 5.88· Pure static · zero execution· Landi N2.5· HTML report, 22,313 bytes· Zero-dependency detection tool + 5 YARA rules

View session Download session archive Import into your AVL Code workspace to replay the full conversation

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model

Overview

  1. 01

    Static identification — a complete verdict of CRITICAL 9.5/10

    You hand AVL Code the sample SHA256 plus one line — "the report must be HTML" — and get an 8-step attack-chain reconstruction and verdict with zero execution.

  2. 02

    Report on disk — a 22,313-byte HTML file ready to archive

    You add one line — "save it as an HTML file" — and the report moves from the conversation into the workspace, readable in a browser and ready to circulate.

  3. 03

    Detection output — zero-dependency tool + 5 YARA rules

    You then ask for a local detection tool and get fast16_detector/ plus rules, tested against 23 findings with 0 false positives verified.

Task for AVL Code

Analyze the sample 9a10e1faa86a5d39417cae44da5adf38824dfb9a16432e34df766aa1dc9e3525 for me, and make the analysis report HTML format

Prerequisites: AVL Code is logged in; the sample is in the workspace as a file (only the hash is kept publicly for this case); writing files needs a writable workspace — in read-only mode the report can only be shown in the conversation

Reproduction materials at the end of this article Try it yourself ↓

Static Identification

The task assignment is a single sentence: give the SHA256, say the report must be HTML. No analysis plan, no environment setup — state the constraints once and leave the rest to execution. Copy the line below and swap in your sample’s hash.

You type → AVL Code 
Analyze the sample 9a10e1faa86a5d39417cae44da5adf38824dfb9a16432e34df766aa1dc9e3525 for me, and make the analysis report HTML format
AVL Code runs → you see
Confirms the sample exists (315,392 bytes) → basic analysis: hash verification / PE parsing / entropy analysis / string extraction / IOCs
→ 32-bit PE console program · overall entropy 5.88, unpacked · compile timestamp 2005 (suspicious, likely forged)
→ Key strings: cmd.exe, service-control APIs, network-share APIs
→ First-pass extraction yields mostly disassembly fragments → reads the .rdata section directly for readable strings and finds rich material
→ YARA engine unavailable → completes the verdict from the data already collected, with the report rendered in Markdown (read-only mode at the time, no file writing possible)

The Report Lands on Disk

The report is already in the conversation, but archiving and circulation need a file. One more line:

You type → AVL Code 
Save it as an HTML file
AVL Code runs → you see
Writes report_9a10….html (22,313 bytes) to the workspace root
→ Verifies the file was written; open it in a browser and read
→ Attaches the report summary: Win32 remote-access trojan / Lua script engine / "fast16" kernel rootkit / service persistence / lateral movement

Build the Detection Tool

The third request is likewise one sentence — the analysis output need not stop at a document:

You type → AVL Code 
Build me a local detection tool that detects this malicious sample
AVL Code runs → you get
Writes fast16_detector/ from the sample’s static features: scanner.py (import table/strings/entropy/scoring) + cli.py + rules.yar (5 rules)
→ Live test blocked by sandbox policy → copies the sample to a temp path and re-tests; after locating an entropy-calculation bug, rewrites the whole file to fix it
→ Re-test: 23 findings · severity=critical (kernel-driver rootkit / service API cluster / lateral movement etc., listed by severity)
→ False-positive check: 0 findings on benign files; within samples/ only the target sample is flagged
→ Delivers HTML output (8,927 bytes) + YARA rule syntax validated

Try it yourself

Download the session and import it into your workspace to replay the whole run, or paste the prompts below in order (swapping in your sample’s hash and paths); once you have the tool, re-verify locally with it:

View session Download session archive Import into your AVL Code workspace to replay the full conversation
› Analyze the sample <sample SHA256> for me, and make the analysis report HTML format
› Save it as an HTML file
› Build me a local detection tool that detects this malicious sample
› python -m fast16_detector.cli <sample path>
› python -m fast16_detector.cli <directory to scan> -o <output report>.html
› yara64 fast16_detector/rules.yar <sample path>
  • Once you have the tool, use the three re-check commands above to verify detection locally.
  • Pure static analysis, zero sample execution; handle suspicious samples in an isolated workspace. In the session the sample scan was once blocked by sandbox policy (the samples/ path restriction), so the tool’s live test was done in a temp path instead.

Next question: How do you wire the 5 YARA rules into the detection line and track their hit rate?