Case study · Spring 2026
AI-Orchestrated Malware Triage
A safety-first analysis pipeline that turns static evidence and external lookups into a structured, plain-English report.
- Discipline
- AI product · Security tooling
- Technology
- Python · React · Claude API · YARA · VirusTotal
STATIC ANALYSIS
01 File type + PE headers verified02 YARA indicators verified03 Model interpretation inferredNO EXECUTION · FAIL CLOSEDOverview
I built a React/Vite and Python tool that coordinates pefile, python-magic, YARA, VirusTotal, and the Claude API while keeping observed evidence separate from model inference.
System map
How the pieces connect
The challenge
What made the problem worth solving
Security analysis needs clarity about what is known and what is inferred. An AI summary that sounds confident but blurs that line can make a triage workflow less safe, not more useful.
The approach
Turning the problem into an engineering plan
- 01
Combined file-type inspection, PE parsing, and YARA rules into one static-analysis pipeline without executing the sample.
- 02
Kept VirusTotal hash lookups off by default and coordinated external evidence through explicit user-controlled steps.
- 03
Structured prompts and reports so observed indicators remained distinct from inferred behavior.
Result
The project became an example of the engineering stance I want to bring to AI products: orchestration is useful, but guardrails, evidence boundaries, and honest uncertainty are part of the feature.