Pull the Indicators Out of a File TRAWL
The first move on an unknown binary is to run strings and comb the output for indicators. TRAWL does both: it lifts the readable text, ASCII and UTF-16, and picks out the IPs, URLs, hashes and keys worth pivoting on.
The file
Drop a binary, dump or document to run strings and pull the indicators out — or
…or paste text below
From strings to a lead
A binary does not hand you a tidy list of what it does, but it leaks: the domain it phones home to, a hard-coded IP for when DNS fails, the path it drops a file to, the registry key it sets to survive a reboot, the hash of what it downloads next. Those are the indicators you pivot on and the ones a detection is written around. TRAWL lifts the readable text and pulls them out in one pass, counted, so the address that appears twenty times is not lost among the noise.