[Hands-on] “AI, Does This Look Like Malware?” 🤖 Initial Determination Using Extracted Metadata

Jul 15, 2026

—

Hello, aspiring security professionals! 🌱

Until last time, we used static analysis tools (PE-bear, Pestudio, Strings) to extract the ‘bones and flesh (metadata)’ from unknown files.

Import Address Table (IAT): The tools this file uses (API functions)
Strings: Hidden texts within the file (IP addresses, messages, etc.)

However, looking at hundreds of API functions and thousands of lines of strings can make your head spin. 😵‍💫 “What on earth does this combination mean?”

This is where our reliable assistant, generative AI (ChatGPT, Claude, etc.), comes into play. When we feed the ‘raw materials’ we’ve extracted to the AI, it provides a first-pass diagnosis based on its vast security knowledge, saying, “This is 90% likely to be ransomware!”

Today, we will conduct a prompt engineering hands-on session to quickly determine maliciousness by inputting extracted metadata into AI. 🚀

1. 📋 Preparations: The Clues We’ve Gathered

Before asking AI, we need to organize the data obtained from the previous hands-on session. The following information should be prepared in a text file or notepad.

Key API List (IAT): CryptEncrypt, WriteFile, InternetOpen, etc.
Suspicious Strings: readme.txt, http://evil.com, cmd.exe, etc.
Basic File Information: File size, compile time, etc. (Optional)

💡 Tip: You don’t need to include all strings. Exclude overly common words and focus on ‘unusual ones’ when preparing.

2. 🗣️ [Hands-on] How to Ask AI (Prompt Writing)

AI is an excellent analyst, but if the questions are poorly structured, the answers will also be poor. You need to assign a ‘persona (role)’ and give specific instructions.

Copy the prompt below and fill it with your data!

📝 Malware Detection Master Prompt

[Role Assignment] You are a malware analysis expert with 20 years of experience.

[Situation] I have extracted the Import API list and internal strings from a suspicious Windows executable (PE) file. Based on this data, I intend to make a preliminary determination of the file’s maliciousness.

[Analysis Data] 1. Key Import API List:

Plaintext

`

(Paste the API list extracted from Pestudio here. E.g., CryptEncrypt, WriteFile…)

`

2. Key Strings:

Plaintext

`

(Paste the strings extracted using the Strings tool here. E.g., Your files are encrypted, .onion…)

`

[Request] Please comprehensively analyze the above data and generate a report with the following content.

1. Maliciousness Suspicion Probability: (Estimate between 0~100%)

2. Expected Malicious Behavior: (Specific type such as ransomware, keylogger, backdoor, etc.)

3. Basis for Judgment (3 or more reasons): Explain based on the combination of APIs and strings. (E.g., Since API A and string B are present together, behavior C is suspected)

4. MITRE ATT&CK Mapping: Specify related attack tactics/technique IDs.

3. 🧪 [Simulation] Actual Input and Result Example

Now, let’s see how AI responds when we input the data extracted from the ransomware sample from last time.

📥 Our Input Data (Example)

API: FindFirstFile, FindNextFile, CryptEncrypt, CryptGenKey, WriteFile, DeleteFile
Strings: All your files are encrypted, bitcoin, restore_guide.txt, .locked

📤 AI’s Analysis Result (Example)

🚨 Malware Analysis Report

1. Maliciousness Suspicion Probability: 98% (Very High)

2. Expected Type: Ransomware

3. Basis for Judgment (Evidence):

– File Exploration and Encryption Combination: Searching for files within the system using FindFirstFile/FindNextFile and performing encryption using the CryptEncrypt API is a typical ransomware logic.

– Identification of Ransom Message: The strings “All your files are encrypted” and “bitcoin” are key keywords in a ransom note demanding money from the user.

– Destructive Behavior: Writing encrypted data with WriteFile and deleting original files with DeleteFile to make recovery impossible is a pattern observed.

4. MITRE ATT&CK Mapping:

– T1486 (Data Encrypted for Impact): Data Encryption

– T1490 (Inhibit System Recovery): Deleting originals and hindering recovery

4. ⚖️ Caution: Do Not Blindly Trust AI! (False Positive Verification)

AI’s answers are not always correct.

For Security Programs: Antivirus programs also use CryptEncrypt (for self-protection) or DeleteFile (for remediation). AI might mistakenly identify these as malicious.
Packed Files: If a file is packed, very few APIs might be visible, leading AI to incorrectly judge it as “seems like a legitimate file.” (In such cases, you should prompt for a result like “Packing is suspected due to too few APIs.”)

Therefore, AI’s results should be used as a ‘preliminary opinion for reference’, and thorough verification must be performed directly by the analyst (that’s you!) through sandbox execution, etc.

🎉 Conclusion: 10x Faster Analysis!

Congratulations! 👏 Now, without having to dissect complex assembly code, you’ve gained the ability to identify the nature of malware in just 5 minutes through the combo of metadata extraction + AI consultation.

This method is a highly useful skill in security operations centers where numerous suspicious files need to be quickly triaged.

Next time, we will move on to an advanced course where we will delve into what servers these classified malware samples actually communicate with (network analysis). Stay tuned! 👋