template.md

Sample Analysis: [Sample Name / Hash]

1. Identity

• Sample name / ID:
• Family (or "unknown"):
• SHA-256:
• File type / architecture:
• Date analyzed:

2. Static & Dynamic Analysis

Behavior Summary

• One-paragraph description of what the sample does:

Control Flow / Behavior Diagram

![Diagram][./artifacts/diagram.png]

Static Analysis

• Key functions identified / named:
• Encryption routine located:
• File traversal / payload logic:
• Obfuscation / packing:

Dynamic Analysis

• Runtime behavior confirmed:
• Files encrypted / touched observed:
• Relevant memory observations (keys, buffers, IVs):
• Static assumptions validated / corrected:

Key APIs Observed

• File / OS behavior:
• Crypto-related:

3. Cryptographic Structure

Crypto Characteristics

• Algorithms / modes used:
• Custom vs standard crypto:
• Hashes / KDFs (if any):

Key Handling

• Key generation method:
• Key size / strength:
• Scope (per-file, per-victim, global):
• Storage / lifetime:

Crypto Control Flow

• Order of operations documented:
• Relation to file traversal:

Crypto Assessment

• Obvious flaws identified:
• Or explicitly: "No practical crypto weakness found"

Optional / Responsible POC:

• High-level pseudocode:
• Decryption feasibility statement: