Pull the indicators out of a file TRAWL
The first move on an unknown binary is to run strings and comb the output for indicators. TRAWL does both: it lifts the readable text, ASCII and UTF-16, and picks out the IPs, URLs, hashes and keys worth pivoting on.
The file
Drop a binary, dump or document to run strings and pull the indicators out, or
…or paste text below
How it works
From strings to a lead
A binary does not hand you a tidy list of what it does, but it leaks: the domain it phones home to, a hard-coded IP for when DNS fails, the path it drops a file to, the registry key it sets to survive a reboot, the hash of what it downloads next. Those are the indicators you pivot on and the ones a detection is written around. TRAWL lifts the readable text and pulls them out in one pass, counted, so the address that appears twenty times is not lost among the noise.
Doing this often? The Sovereign Console pulls every string, indicator and timestamp out of a whole case at once, and exports a report. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.