specialized-file-analyzer

Specialized File Analyzer

Expert analysis of non-PE file formats commonly used in malware campaigns: .NET, Office documents, PDFs, scripts, HTA files, disk images, archives, and Linux binaries.

When to Use This Skill

Use this skill when analyzing:

• .NET/C# assemblies (.exe, .dll with .NET framework)
• Office documents with macros (.docm, .xlsm, .doc, .xls)
• PDF files (suspicious attachments, exploit documents)
• Scripts (PowerShell .ps1, VBScript .vbs, JavaScript .js)
• HTA files (.hta — HTML Applications executed by mshta.exe)
• Disk images (.iso, .img, .vhd, .vhdx — container formats that bypass MOTW)
• Archives (.zip, .rar, .7z, .tar.gz)
• Shortcuts (.lnk files)
• Linux binaries (ELF executables)
• Batch files (.bat, .cmd)

Key indicator: file command shows non-PE32 executable or document type.

Execution Model

• You run the commands. Every bash block in this skill is for you to execute on the host, then read and interpret. Do not ask the user to run tools and paste output unless a tool is missing and cannot be installed.
• Locate skill files. Scripts and reference files ship in this skill's directory. Set R="${CLAUDE_PLUGIN_ROOT:-<dir containing this SKILL.md>}" once (when installed as a plugin $CLAUDE_PLUGIN_ROOT is set; otherwise it is this skill folder). Your working directory is the user's analysis workspace, so prefix every script path below with $R, e.g. python3 "$R"/scripts/ioc_extract.py.
• Nothing gets executed. Decompile, extract, decode, beautify, grep — never run the sample, a macro, a script, or an extracted payload on the host. Blocks marked VM only (PowerShell, cscript, strace, dnSpy debugging) are for the analyst in the isolated VM; hand them over as instructions and analyze the text they bring back.
• Static deobfuscation first. Base64, hex, Chr(), Replace(), StrReverse, string concatenation: resolve them with Python on the host. Only when a stage is genuinely runtime-dependent (Execute of a downloaded blob) do you ask for a VM run.
• Tool check once per session, then degrade gracefully:

  command -v 7z unzip olevba oledump.py pdfid.py pdf-parser.py ilspycmd js-beautify lnkinfo readelf upx exiftool
  # olevba/oledump/XLM: pip install oletools        pdfid/pdf-parser: git clone https://github.com/DidierStevens/DidierStevensSuite
  # ilspycmd: dotnet tool install -g ilspycmd        js-beautify: pip install jsbeautifier        lnkinfo: apt install libyal-lnk-tools (or pip install LnkParse3)
  

  On REMnux everything above is preinstalled. If a decompiler/parser is unavailable, fall back to strings -a -n 6 (and -e l for UTF-16) plus targeted grep — say so in the findings.
• Every extracted stage is a new file: file it, hash it, record it in analysis_state.md, and route it (PE → malware-triage; another document/script → the matching section here).
• Finish every file type by running the extracted text through python3 scripts/ioc_extract.py (repo root) so the IOCs land defanged in the state file.
• Big outputs (decompiled projects, olevba on a large workbook): write to a file, wc -l, then grep — never cat blindly.