Concepts
Report
What the report contains, how its citations lead back to the ledger, and what the code checks before it is stored.
The report is written by the reporter agent from the claims in force, the judge's verdict and the ledger. It reads like a professional malware report. The difference is that every statement in it can be traced to the tool call that proves it.
Sections
| Section | What it holds |
|---|---|
| 1. Executive summary | The key findings, each with its citation, and the verdict. |
| 2. Introduction and scope | What was analysed, with which tools, and what was not available. |
| 3. Sample metadata | Hashes, file type, size, signature, sections, imports. |
| 4. Execution flow | What the sample does, step by step. |
| 5. Functionality | Obfuscation and anti-analysis, API resolution, persistence, discovery, payloads. |
| 6. Command and control | Protocol, endpoints, configuration, commands. |
| 7. Conclusion | What the evidence supports, and how firmly. |
| 8. Detection | Indicators, detection rule drafts, hunting guidance. |
| 9. Recommendations | What a defender should do. |
| 10. MITRE ATT&CK mapping | Each published technique with its evidence, and the techniques the judge dropped, with why. |
| 11. Limitations | What the run could not establish, and why. |
| Appendix | The detection rules in full, analyst statements that add detail, references. |
Where no sandbox ran, the report says so in one sentence instead of printing empty tables.
An excerpt
From the report of the benchmark run. Live indicators are defanged by the report itself.
Verdict: Malware (high confidence) · Severity: High · Family: Latrodectus (moderate-to-high confidence)[1] · Category: downloader / backdoor (Latrodectus-family implant)
1. Executive summary
- The sample reaches two decoded candidate C2 URLs, hxxps://titnovacrion[.]top/live/ and hxxps://skinnyjeanso[.]com/live/, through a WinINet beacon that uses the POST verb, a Content-Type of application/x-www-form-urlencoded and the user-agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1). The report body carries fields such as counter, guid, os, arch, username, group, ver and up, and the sandbox recorded no HTTP session to either domain.[2]
- The sample's sandbox run recorded no C2 contact, dropped file or registry activity, and no local YARA rule matched; in the 576-second packet capture none of the 14 external conversations is attributed to it. The only sandbox-observed processes are two rundll32.exe launches of the sample with the #1 export and an unattributed svchost.exe -k GPSvcGroup process.[9]
6.1 Protocol and endpoints
The sample's C2 is HTTP(S), built around two candidate endpoints. Its decoded strings are hxxps://titnovacrion[.]top/live/ and hxxps://skinnyjeanso[.]com/live/[106]. Routine 0x6988 decodes both into a two-entry table at DAT_1360bc10568, and the table is filled from the install routine 0x3868[83].
Each bracketed number is a note in the evidence bundle. Each note lists the ledger entries it rests on:
| Note | Entries | What they are |
|---|---|---|
| [1] | ev_0014, ev_0106 | The sandbox's signatures; the dynamic analyst's read of the sandbox's extracted items |
| [2] | ev_0019, ev_0021, ev_0020, ev_0013, ev_0026 | FLOSS; decoded string blobs; API hash resolution; the sandbox's network; the sandbox's sections |
| [9] | ev_0007, ev_0013, ev_0015, ev_0017, ev_0012, ev_0028 | YARA; the sandbox's network; its dropped files; the capture summary; the sandbox's processes; the links from behaviour to code |
| [106] | ev_0019, ev_0021, ev_0050 | FLOSS; decoded string blobs; the static analyst's byte transform |
| [83] | ev_0067 | The reverser's decompile of six functions, 0x5750 and 0x6988 among them |
Note how the report keeps two kinds of fact apart: what was read from code and what was observed in the sandbox. Every statement says which it is.
What the code checks
The reporter writes; the code checks. Before the report is stored:
- every citation must name an entry that exists and holds the value the sentence states;
- the closing sections, the Conclusion and the Limitations, are held against the body and the ledger, so a "not established" sentence cannot contradict a section that establishes the fact;
- an absence sentence ("no file was written") is held against the ledger;
- an indicator is published only with a reason, and the reason is printed beside it in the IOC feed and the detection drafts.
A failed check goes back to the reporter with a validation code and one turn to fix it. A problem it does not fix stays visible in the run summary.
The evidence bundle
Beside the report sits the evidence bundle, as HTML and JSON
(malspark-evidence-bundle/1). It prints every section as the report does,
every note with its entries, and an index of every ledger entry: agent, tool,
source and outcome. A reader with only the bundle can check every citation.
Formats
The same report is served as Markdown, HTML, PDF, the full JSON document, STIX 2.1, an ATT&CK Navigator layer, an IOC feed and detection drafts. See Reports and exports.