malware-analysis

Malware Analysis Skill

This skill produces analyst-grade threat reports — not data dumps. Every conclusion must be backed by evidence and reasoning.

Core Principles

1. Evidence-based reasoning: Never state a conclusion without explaining WHY
2. Connect the dots: Link indicators to behaviors to capabilities to impact
3. Assess confidence: State how confident you are and why
4. Actionable output: Reports should enable decisions, not just inform

Analysis Workflow

Step 1: Collect Data

Run all scripts to gather raw data:

# Static analysis - get hashes, PE info, strings, APIs, entropy
python3 scripts/static_analysis.py /path/to/sample -f json > static.json

# Threat intelligence - check reputation across sources
python3 scripts/triage.py -t file /path/to/sample -f json > triage.json

# IOC extraction - extract network/host indicators
python3 scripts/extract_iocs.py /path/to/sample -f json > iocs.json

Step 2: Analyze and Reason (THIS IS THE KEY STEP)

Using the collected data, perform analyst-grade reasoning:

2.1 Threat Intelligence Assessment

Ask yourself:

• Is this sample known? If found in MalwareBazaar/ThreatFox, it's confirmed malware
• What's the VT detection rate?
  • 0 detections: New sample, FP, or clean — requires behavioral analysis
  • 1-5 detections: Possibly new variant or targeted — suspicious
  • 5-15 detections: Confirmed malicious by multiple vendors
  • 15+ detections: Well-known malware
• What family is it attributed to? Research that family's typical behavior
• When was it first seen? Recent = active campaign

Always explain your reasoning:

"This sample is identified as RedLine Stealer by MalwareBazaar with 45/70 VT detections. The high detection rate and presence in curated malware repositories confirms this is a known threat, not a false positive."

2.2 Behavioral Analysis from Static Indicators

API Analysis - Map APIs to behaviors: