strings + grep

strings <sample> | grep -iE '(http|c2|api)'

Extract strings from a sample and filter for patterns of interest (URLs, C2, API) - the fastest triage in malware analysis.

Run it when you need a first picture of the sample in seconds: strings extracts readable strings from the binary and grep filters for what matters - URLs, domains, paths, commands. The result is candidate IOCs: the C2 URL, the dump path, the registry key. It's the first step of any static analysis, often giving the answer outright (a sample with a plaintext C2 URL is identified without further tools). In IR, strings+grep is the immediate triage for each new sample before moving to heavy tools.

Don't use it as analysis: strings sees what's in plaintext - obfuscated or packed samples (UPX, XOR) don't show their real strings; for those, use FLOSS and unpacking. Grep for generic patterns (http, api) generates noise: legitimate binaries contain common URLs and words - filter results by relevance. And watch encoding: strings defaults to ASCII; binaries with UTF-16 strings (Windows) require -e l. For full analysis, strings is the appetizer: layer, FLOSS, and the sandbox are the main course.