Reading a File
What malware analysis of a single file looks like in Stairwell -- static analysis and binary structure, code signing, similarity, prevalence, enterprise sightings, historical DNS, dynamic analysis and an AI-written assessment.
Most investigations are one file at a time, and nearly all of them start on the same screen. The Object Panel is that screen.
What makes a Stairwell read of a file different from opening it in a local analysis tool is that nine kinds of evidence arrive together, and four of them are not properties of the file at all -- they are properties of the file's relationship to your fleet, to the world, and to time.
The nine dimensions
| What it answers | |
|---|---|
| Static analysis | What the bytes are: hashes, detected format and architecture, size, timestamps, embedded metadata |
| Binary structure | For PE, ELF and Mach-O: sections, imports, exports, and the capabilities identified in the code |
| Code signing | Who signed it, the certificate chain, and whether the signature actually verifies |
| Content | Strings, raw bytes, and a binary image in which packing and encryption are visible without reading a single string |
| Malware similarity | What else resembles it, across your own files and a global malware corpus -- the question that survives an adversary recompiling. See Variants |
| Prevalence | Whether it is rare or ubiquitous, both inside your fleet and globally. See Prevalence |
| Enterprise sightings | Which of your machines held it, at which paths, under which filenames, first and last seen. See Sightings |
| Historical DNS | For every hostname inside it, what that name resolved to over time and what else shared those addresses. See Hostnames and IP Addresses |
| Dynamic analysis | The infrastructure the file reaches for when executed. Beta, and not a full sandbox |
On top of those, AI Triage writes the synthesis: an AI malware analysis of the one file, with a malicious likelihood, a confidence score, a specific threat type, the indicators worth pivoting on, and a MITRE ATT&CK mapping tied to observed behavior rather than a generic list.
For the complete inventory, including which of these are derived from the bytes and which change on their own as the world learns more, see What Stairwell Knows About a File.
Why the last four matter most
The first five dimensions are what any competent analysis tool gives you. The last four are the ones a local tool cannot produce, because they require history that the file itself does not carry.
A binary opened in a disassembler is the same binary today as it was last year. The same binary in Stairwell is a different read: it is now rare where it used to be unremarkable, its family has three new members, one of its hostnames started resolving in March, and it turns out to have been sitting on eleven machines since before anyone had a name for it.
That is why retrospective threat hunting works here and does not work against a rolling telemetry window. The evidence is not a snapshot taken on the day the file arrived.
Where to go from a single file
Reading one file is where an investigation starts, not where it ends. Two moves widen it:
- Run-to-Ground for incident scoping -- what else landed on those machines alongside this file, including the things nothing flagged. Launch it by right-clicking any hash and choosing Workflows → Run to ground.
- YARA rules for the temporally unbounded version. A rule written today is evaluated against files collected years ago, so a YARA retrohunt across your own history is the same action as writing the rule.
What should I read next?
- The Object Panel, for where each dimension appears on screen and the order to read them in.
- What Stairwell Knows About a File, for the full inventory and its limits.
- Variants and Sightings, for the two dimensions that most often turn one file into an incident.
Updated 19 days ago