classify

Storage Policy: ALL output files MUST be saved in the project directory. NEVER write to /tmp/ or any system temporary directory.

Malware Classification

Parse $ARGUMENTS to get the binary path.

Step 1 — Hash & Identify

node "${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js" hash "$ARGUMENTS"

Step 2 — Entropy Analysis

Use radare2 for per-section entropy:

r2 -qc 'iS~entropy' <binary>

Or use Python pefile:

python3 -c "
import pefile, math
pe = pefile.PE('$ARGUMENTS')
for s in pe.sections:
    data = s.get_data()
    if len(data) == 0: continue
    entropy = 0
    for x in range(256):
        p = data.count(bytes([x])) / len(data)
        if p > 0: entropy -= p * math.log2(p)
    name = s.Name.decode().rstrip('\x00')
    print(f'{name}: entropy={entropy:.2f} size={len(data)}')
"

Interpretation:

• 0-1: Empty/null data
• 1-5: Normal code/data
• 5-7: Compressed or obfuscated
• 7-8: Encrypted or packed (HIGH confidence)

Step 3 — Packer Detection

Known packer signatures:

• UPX: Section names UPX0, UPX1, or UPX! magic
• ASPack: Section name .aspack or .adata
• Themida: Section name .winlicense or .themida
• VMProtect: Section name .vmp0, .vmp1
• .NET Reactor: .reacto section
• Enigma Protector: .enigma section

Check with file:

file <binary> | grep -i "packed\|UPX\|compressed"

Step 4 — YARA Scan

yara -r /usr/share/yara/rules/ <binary> 2>/dev/null
yara -r /opt/yara-rules/ <binary> 2>/dev/null

If no YARA rules are installed, note this and suggest installing community rulesets.

Step 5 — ssdeep Similarity

ssdeep <binary>

Compare against known samples if a reference database exists.

Step 6 — IOC Extraction

From strings and structure, extract:

• C2 server addresses (URLs, IPs)
• Mutex names (unique identifiers)
• Dropped file paths
• Registry persistence keys
• Scheduled task names
• Service names