1. Evidence-based reasoning: Never state a conclusion without explaining WHY
2. Connect the dots: Link indicators to behaviors to capabilities to impact
3. Assess confidence: State how confident you are and why
4. Actionable output: Reports should enable decisions, not just inform

• Is this sample known? If found in MalwareBazaar/ThreatFox, it's confirmed malware
• What's the VT detection rate?
  • 0 detections: New sample, FP, or clean — requires behavioral analysis
  • 1-5 detections: Possibly new variant or targeted — suspicious
  • 5-15 detections: Confirmed malicious by multiple vendors
  • 15+ detections: Well-known malware
• What family is it attributed to? Research that family's typical behavior
• When was it first seen? Recent = active campaign

"This sample is identified as RedLine Stealer by MalwareBazaar with 45/70 VT detections. The high detection rate and presence in curated malware repositories confirms this is a known threat, not a false positive."

"The presence of VirtualAlloc, VirtualProtect, and CreateRemoteThread together strongly suggests process injection capability. Individually these APIs have legitimate uses, but this specific combination is the textbook pattern for injecting code into other processes."

"This sample shows multiple packing indicators (entropy 7.4, UPX sections). The static analysis findings represent the unpacker stub, NOT the actual payload. Dynamic analysis is required to reveal true functionality."

"Credential Theft Capability: HIGH CONFIDENCE — CryptUnprotectData is present, which specifically decrypts DPAPI-protected data including browser passwords. This API has no legitimate use case in most software."

• VirusTotal: [X/Y detections] — [what this means]
• MalwareBazaar: [Found/Not found] — [what this means]
• Family Attribution: [Family name] — [what this family typically does]

• Confidence: [High/Medium/Low]
• Evidence: [List the specific APIs/strings found]
• Reasoning: [Explain WHY this evidence indicates this capability]

1. [Reason 1]
2. [Reason 2]
3. [Reason 3]

• [Why this confidence level]

"Found APIs: VirtualAlloc, CreateRemoteThread, RegSetValueEx. Entropy: 7.2. VT: 34/70."

"This sample demonstrates process injection capability (HIGH CONFIDENCE) based on the presence of VirtualAlloc and CreateRemoteThread. These APIs, when used together, form the classic code injection pattern where memory is allocated in a target process and a thread is created to execute the injected code. The high entropy (7.2) suggests the payload is packed, meaning the observed APIs may belong to the unpacker stub rather than the final payload. The 34/70 VirusTotal detection rate confirms this is recognized malware, with multiple vendors identifying it as a variant of Agent Tesla — an info-stealer known for credential harvesting. Given the injection capability and association with a credential-stealing family, this sample poses a CRITICAL risk to credential security on any system where it executes."